Fix signin with OmniAuth providers

OmniAuth CSRF protection was broken with the move to Rails 4.2 since
the CSRF logic in Rails changed. 

This new implementation calls out to Rails instead of copying its code,
which is far easier to maintain.

See merge request !2019