Switch CSRF token rendering mechanism.

Switch Register CSRF protect from form.hidden_tag to input hidden
value=csrf_token.
I don't understand why this is necessary, as form.hidden_tag works
elsewhere--this may be a symptom of an aliasing issue. However, it was
the solution applied to fix login in a previous commit as described in
https://github.com/sloria/cookiecutter-flask/issues/34.

Update Bootstrap and Font Awesome to latest version

Update stale Python requirements

Enable CSRF protection

- CSRF is enabled by default for login form
- This commit resolves issue #34

Update README.rst to include bower install step

Fixes https://github.com/sloria/cookiecutter-flask/issues/62

Init the flask-migrate extension first

fix db fixture for model tests

Add psycopg2 to production requirements

Add a lint command with flake8 and isort

Update requirements, pin modules to the latest version, …

Add `urls` and `clean` commands to manage.py

Two new useful commands for manage.py. `m urls` lists all URLs (like `rake routes` in Rails). `m clean` gets rid of .pyc files.