Add csrf_token() to Jinja2 globals

Installing csrf_token() in the render context only causes errors in
imported Jinja2 templates. It can be avoided by explicitly importing
templates with context, but it is a cognitive burden to remember which
templates should be imported with context and which don't have to be.