fix bug 906883 with browserid_form and csrf_exempt

This makes browserid_change_email work the same as browserid_verify,
since _verify_browserid on the assertion is an effective CSRF protection