Restore CSRF functionality to deform pages
bump pyramid-layout version

changelogs say fixes Pyramid 1.5 issues.
Updated comment to reflect new info
Revert "Remove unused CSS"

This reverts commit ca43ccc1d9559476f95c714c1b055194f03dd0c2.
Update pyramid_webassets

We can drop our manual bundle loading and just set a default YAML file
in the settings.
Remove last references to deform.js
whitespace