improve flask configuration managament

This fixes CSRFProtect so it works in deployment and also is correctly disabled
when running tests locally.