Add multipart file upload CSRF gotcha solution

When you do non-ajaxy form file submissions, if the file is big, it won't load the CSRF before the file finishes uploading, and it bails. Being sure to include the CSRF field first in the form is the way to have that not happen.