Allow csrf to be disabled for testing.

Not the ideal solution but life is easier this way.
Simple tests of shopping.
Add declined template.
Use the Factory object.
Update install and checkout modules.