Return the CSRF token from /api/v1/login/facebook

@phleet review please?

## Test plan

Ran `curl -d 'fb_access_token=thispathisreckless' -i http://localhost:5000/api/v1/login/facebook`, ensured response's cookie value contains the encrypted CSRF token and the response body contains the unencrypted CSRF token.

Also clicked around on web app and made sure things weren't broken.