Fixed a bug with csrf and allowing api/hooks routes

The CSRF protection was blocking the api and hooks routes because it was
on for all routes. The custom csrf middleware now correctly disables
CSRF protection for those routes.

It also creates a new CSRF token for the 404 and 500 error pages so
users can still login after hitting those pages if they get there
through a route that has CSRF disabled already.