Remove session-csrf

[adamalton]

This is now included as part of Django (from 1.10 I think), so we don't need to use the separate repo.

[davidwtbuxton]

New in Django 1.11. https://docs.djangoproject.com/en/1.11/ref/settings/#std:setting-CSRF_USE_SESSIONS

Note that mozilla/django-session-csrf allows using memcache to store tokens for anonymous users, rather than a full session. Django's session-based csrf implementation does not.