Remove all extra CSRF protection from views

All CSRF protection is being handled by the form validation step. This also works around Flask-WTF's decision to freeze the state of the WTF_CSRF_ENABLED config value at init_app time.
Add tests for evesrp.views.login

Testing login, logout, AuthMethod-specific views and that multiple AuthMethods render tabs properly.