remove csrf tests

Per a discussion in irc with the team [as well as <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1000908#c9">bug 1000908</a> we no longer need to validate the presence of a csrf token.

Included in this pr:
* remove all `csrf token` assertions
* remove the `xfails` for the login and logout tests