Show form-wide auth failures inline

This is a step better than flash messages. It could be reworked to
inline above the submit button, or elsewhere, easily by changing the
template.
Return auth failure reasons as form-wide errors

This avoids flash messages for common errors such as bad credentials
and shows them inline instead.
Return a 403 code on bad CSRF token