refactor new-collection/entity-id code to return better errors

- Code for getting CSRF token consolidated into single function.
- Throw exceptions instead of failing silently.
- collections/entity.new view code prints errors to alert boxes.
docstore.post can figure out object type so no need to pass in