Fix attempts to reauth non-existent user.

In response to an invalid CSRF token devise has a [handler](https://github.com/plataformatec/devise/blob/master/lib/devise/controllers/helpers.rb#L176-L183) that forces a sign_out as a precaution.  This gets triggered even if there is no user currently signed in, and therefore the before_logout hook gets called with a nil user.  This was causing a NoMethodError.

Writing a test for this involved having to shave several Yaks.  Firtsly enabling CSRF protection in integration tests, then tweaking rack-test to not respect `data-method` attributes, and then adding the JS driver to be able to use links with `data-method` attributes, and have CSRF protection work.