re-enable xsrf protection on /milestone
Merge branch 'staging' of github.com:code-dot-org/code-dot-org into staging