Bug 698427: Switch to django-session-csrf

DO NOT MERGE THIS YET.

This depends on [kuma-lib pull 18](https://github.com/mozilla/kuma-lib/pull/18), which actually adds django-session-csrf.

Use of the `anonymous_csrf` decorator is sparse here; I think I've hit everything that absolutely needs it, but wouldn't mind a sanity check.