Use CSRF during tests (fixes oauth tests with _session_id)
require POST for oauth app authorization form submit