Add the anonymous CSRF token on password reset (bug 1069546)

This fix potentially introduces a security flaw so I need double check prior merging :)

Yay for pytest, no need for `ok_` or `self.assertIn` or the like ;)