Fix #247: Execute lazy callables for csrf_token within the view.

Django’s CSRF middleware does not send a CSRF cookie if the csrf_token
value, which is a lazy-evaluated value, is called. This avoids 
unnecessary cookies, but causes trouble if you don’t evaluate the 
csrf_token within your view.

CsrfToken was doing just that, as it just passed the value to 
HttpResponse, not evaluating csrf_token before the middleware ran and
decided not to send the cookie. By `unicode`ing the value we force it
to run and the middleware sends the cookie as expected.