Exclude /api/v1/login/facebook from CSRF protection

@phleet Review please?

Fixes #83 

Although 18fcc72 prevents an attacker from replacing a logged-in user's account with the attacker's account, it doesn't prevent an attacker from just logging in a logged-out user as the attacker. I'm not sure what to do about that. :/

The CSRF token can be extracted from the session cookie (that's returned by this endpoint) if API clients require it.

### Test plan

Before fixes, ran

```
curl -i -d 'fb_access_token=...' 'http://localhost:5000/api/v1/login/facebook'
```

... which returned a 403 Forbidden. After fix, returned 200 with a session cookie in the header.

Also verified that a CSRF attack on this endpoint on a logged-in user will fail, like the following:

```html
<script>
window.onload = function() {
  var form = document.getElementById("frm");
  form.submit();
};
</script>

<form action="http://localhost:5000/api/v1/login/facebook"
    method="POST" id="frm">
  <input type="hidden" name="fb_access_token" value="..." />
  <input type="submit" />
</form>
```