Skip CSRF verification on OmniAuth callbacks

The OpenID provider gives us back a direct POST with no token.