Fix bulk edit without JavaScript

A change in Rails 4.0 (which wasn't mentioned in the release notes) made `form_tag` with `remote: true` not include `authenticity_token` in the form by default. This meant that bulk edit didn't work without JavaScript.

- enable request forgery protection for features: this means that features will fail if `authenticity_token` is ever missing from a form (and 8 do fail for bulk edit without js)
- include `authenticity_token` in the mappings table form so that bulk edit works again

Enabling request forgery protection for features doesn't appear to make them take any longer to run: for the passing build here they took 59.481s compared to 59.011s for the last build on master.
I agree with this change, but let's not put it here. `env.rb` can be regenerated via tasks. Anything under `features/support` will be loaded, and we've put other settings like this there, so let's find a place to put it alongside.