Inline auth form errors
Color borders for valid/invalid form field states
Auth controller no longer needs flash service
Show form-wide auth failures inline

This is a step better than flash messages. It could be reworked to
inline above the submit button, or elsewhere, easily by changing the
template.
Return auth failure reasons as form-wide errors

This avoids flash messages for common errors such as bad credentials
and shows them inline instead.
Return a 403 code on bad CSRF token
Merge pull request #1279 from hypothesis/improved-form-errors

Improved form errors