Added ability to display Activities in CSV format in html page

https://jira.ets.berkeley.edu/jira/browse/CYB-59
A few points here:

* Both forms (the existing JSON, and the CSV) are security holes as it stands.  Security by obscurity is not security at all.  Any validated use could call one of these routes.
  * If we opt to defer the security, create an epic for adding security, and put this specific issue as the first ticket to keep the epic from dropping from view.  It's Eli's call on security now or later.  POC will work without it, but it should not be ignored.
* Possibly use #send_file (see http://api.rubyonrails.orb/ ) in ActionController.  You can also suggest a helpful file name with more than just 'Student Activity' as its name but also add things like course name, section if it is for a TA, and semester.
* If the call to this from the front end is NOT via JavaScript then it belongs in a different controller (at least different namespace, in the root app/controllers, not here in app/controllers/api/v1/ ).  If it is to be done via JavaScript then it will stay here, and it will **require** the use of '#send_file' (because then it doesn't open its own page -- the data will be inaccessible.
* Minor stylistic issue -- we should settle on one format for when hashes have symbol keys.  I'd prefer the ruby 2 form ( {foo: 12}) over the ruby 1 form ({ :foo => 12 }) -- it calls out that the keys are symbols, and is also generally the preferred style in code elsewhere.

Thanks