CSRF the login and 2FA forms
Merge branch 'brandur-csrf-login'
Temporarily exempt POST /login from CSRF

This is part of a two phase deploy so that users who were between the
login form on the login form's target during the CSRF change don't get
white screened because they don't have a token. Start passing through
tokens now, then require CSRF token on the next deploy.
Revert "Temporarily exempt POST /login from CSRF"

This reverts commit 7efedf3667d9a39f7e573fe073c4618503df7507.

(Phase 2 going ahead.)