Fix preload token issues.

We need to get the CSRF token working correctly. This change does the following:

1. Stops defining the token
2. Stops redefining the token in the user state JS

The token is actually already getting inserted between the `head` and `body` tags. We still need to put a HTML comment int the head to define the insertion point of the token.