Make all the buttons Watch/Unwatch, Request/Drop rely on a form CSRF protected

Fixes https://fedorahosted.org/fedora-infrastructure/ticket/4368
Adjust the unit-tests for the changes in the acl controller to use POST w/ csrf protection