Fix incorrect return type
Add a fake CSRF token to the session. When forms are rendered it's
expected to be there, and since we turn off CSRF for tests it won't
be unless we add it here.