Include authenticity_token for non-js bulk edit

Since Rails 4.0, remote forms have not included authenticity_token
by default:

    https://github.com/rails/rails/commit/128cfbdf4d316a544a76e5c58dbeac153f3d4e36

The form_tag needs to have `remote: true` to work in the modal, but
also needs the authenticity token to work without JavaScript. This
commit includes the token in the form via the helper's options and
fixes the features which were failing on the missing token. We
don't use remote forms anywhere else in the app.