Fix case session['_csrf_token'] isn't populated

Assume two users visit an action that is setup for caching. If the page is not cached when the first user hits it, the page will be generated for them and `token_tag` creates a csrf token in `session['_csrf_token']`.

As the session var exists, the substitution can be done for the first user.

However, when the second user hits the action it's cached, so `token_tag` won't be able to generate a csrf token for them.

Calling `form_authenticity_token` instead of manually accessing the session object ensures that the token is created for the user, regardless of whether `token_tag`/`csrf_meta_tags` was called during the request.