Re-enabled CSRF protection for Policies and Divisions.

This removes the lines disabling CSRF protection, and switches the manual form tags back over to `form_for`.

(Fixes #445.)