Switch CSRF token rendering mechanism.

Switch Register CSRF protect from form.hidden_tag to input hidden
value=csrf_token.
I don't understand why this is necessary, as form.hidden_tag works
elsewhere--this may be a symptom of an aliasing issue. However, it was
the solution applied to fix login in a previous commit as described in
https://github.com/sloria/cookiecutter-flask/issues/34.