All client-side templates have 'csrfToken' in their context now.

nunjucks doesn't seem to support the idea of an environment that contains
context globals, like jinja2 for python does, so I added a bit of support
for it. Ideally we would push this upstream rather than hack our use of it,
but WE'VE GOT DEADLINES.
Added a POST /share/badge/:badgeId route and a button in UI to trigger it.