Do URL encoding of csrf_tokens correctly.

Only encode the token at points of transfer: in the cookie itself
and when POSTed in forms.
flake8 cleanups in tests
release 0.5.1