Enable request forgery protection for features

Bulk edit without js has been broken for a few months due to a missing
authenticity_token, and we didn't notice. This change will mean that
features should fail if we do this again.
Remove trailing whitespace from 2 lines.
Include authenticity_token for non-js bulk edit

Since Rails 4.0, remote forms have not included authenticity_token
by default:

    https://github.com/rails/rails/commit/128cfbdf4d316a544a76e5c58dbeac153f3d4e36

The form_tag needs to have `remote: true` to work in the modal, but
also needs the authenticity token to work without JavaScript. This
commit includes the token in the form via the helper's options and
fixes the features which were failing on the missing token. We
don't use remote forms anywhere else in the app.