Fix CSRF implementation for tests

We now add application secret to the FakeApp and provide a
FakeCSRFRequest class for testing CSRF-controllers.
Rename email preferences fields to match API

This ensures error messages are displayed correctly for the user if
there is a problem in the ID API.