Add CSRF protection for AJAX calls

Without this setup, $.ajax POSTs and DELETEs fail.
Add link for forgotten username
Merge pull request #173 from maurizi/forgot-login-link

Add link for forgotten username
Register and cancel from event page via AJAX

I extracted the RSVP markup into a partial so it can be rendered and
returned as the response from the register and unregister views.

The workflow for making an AJAX request and replacing content with the
response was not specific to event registration, so I implemented a
reusable fetchAndReplace function.
Merge pull request #162 from azavea/feature/jcw/rsvp-from-event-detail

RSVP from event detail page
Adjust profile page per spec revisions
Emails tab: opt out of e-mails for specific events
Privacy tab: "public/private" instead of "lock/unlock"

Also, only show icon when private.
User privacy controls

Back end:
* Separate `PrivacySettingsForm` from `ProfileSettingsForm`
* User settings page: stay on page after save or cancel (per JeffF)
* Postback to user profile updates privacy settings

Front end:
* Add bootstrap modal to show privacy settings on profile page
* Module `privacySettings.js` controls toggling and display of privacy settings
* Used in both user profile and settings pages, each with their own save and cancel buttons