Enable CSRF protection by default

Enable CSRF protection by default

Most of these forms look pretty benign, but the user profile form, which
includes an SSH key field, certainly needs to be protected.

The survey form is unprotected because it's served over insecure HTTP
and the Varnish proxy strips cookies, which is required by the builtin
CSRF protection.

Marti Raudsepp