Forcing the login and registration pages to send a CSRF cookie

I'm still getting #37 sporadically.  It usually occurs on a "cold start" of the server,
with the DB nuked and me registering new users.
Attempt at #37, SERVERONLY permission fixed, stream works as intended

So #37 is an elusive one.  The last commit did not work.  I've gone and changed render()
calls to render_to_response(), as render_to_response() seems to be a helper function that
does more things behind the scenes than render().

SERVERONLY now is considered "Dogenode friends only", so users can only see posts marked as
SERVERONLY if they are locally friends with the posts' authors.

The stream used to show all public posts, but that defeats the purpose of following someone.
So, the only public posts the stream will display are the ones made by those a user is
following.