Avoid hard-coding the csrf cookie name

[jacobtylerwalls]

Throughout the frontend, we assume that the name of the CSRF cookie is csrftoken. That's the default supplied by Django, but it's configurable via CSRF_COOKIE_NAME, and especially as we move to arches applications architectures, we might want to start disambiguating it?

Suggest that we expose this setting to the frontend so that, for example, a vue frontend no longer hard codes this default name.

[jacobtylerwalls]

May as well handle CSRF_HEADER_NAME at the same time.