add an ensure_csrf_cookie in the create_new_course entry point