fix bug 906883 with browserid_form and csrf_exempt

This makes browserid_change_email work the same as browserid_verify,
since _verify_browserid on the assertion is an effective CSRF protection
Merge pull request #2346 from groovecoder/change-email-bug-906883

fix bug 906883 with browserid_form and csrf_exempt