Setup poltergeist.

Also required setting up database_cleaner to use truncation instead of transactions for the integration tests.
Enable CSRF protection in integration tests.

This has required using the javascript driver for tests that follow links that rely on the data-method attribute.
Fix attempts to reauth non-existent user.

In response to an invalid CSRF token devise has a handler[1] that forces
a sign_out as a precaution.  This gets trifggered even if there is no
user currently signed in, and therefore the before_logout hook cets
called with a nil user.  This was causing a NoMethodError.

[1] https://github.com/plataformatec/devise/blob/master/lib/devise/controllers/helpers.rb#L176-L183