Ensure auto-auth feature flag actually disables CSRF

Remove CSRF middleware/processor in aws and dev settings, instead of common settings.  This ensures that we load the `MITX_FEATURES` token BEFORE deciding to disable CSRF.

This is impossible to unit test, since doing so would require uninstalling Django middleware.  I verified the change manually by (a) overriding the `AUTOMATIC_AUTH_FOR_LOAD_TESTING` feature flag in lms/envs/dev.py and (b) creating env.json tokens that set the feature flag, then loading the tokens using lms/envs/aws.py.  I tested the HTTP status codes using `requests` to POST to `/login` (usually CSRF protected).

Existing unit tests guarantee that CSRF is still enabled with default settings.

This PR includes the changes in Ed's PR, so it won't conflict with the changes in #544 

Reviewers: @jzoldak @e0d 

As soon as this gets merged, I can gp-deploy to the load test env and start executing the load tests.