add an ensure_csrf_cookie in the create_new_course entry point

Seems like there was a security hole here.

@singingwolfboy can you review? Thx.