Redirect to referer during most CSRF errors

[monfresh]

Why: Signing the user out and redirecting them to the sign in
page is not helpful when they encounter a CSRF error. For example,
if they get a CSRF error while creating their password for the first
time during account creation, they might not know what they should
do to get back to the password creation screen.

Instead, we should try to redirect back to where they were so they can
try again. One exception is on the personal key screen. Due to the way
the feature works, we can't take the user back to the personal key
screen without modifying the session and regenerating a new key for
them. We don't want to make any state changes as a result of a CSRF
error for security reasons. Instead, we sign them out and redirect
to the sign in screen.

Users::SessionsController also has its own way of rescuing the
CSRF error because the only way I could get the flash message to
appear was to call sign_out, and we don't want to call sign_out
in ApplicationController. Also, in order to preserve the request_id
(so that users can go back to the SP), we need to use redirect_back,
whereas in the Personal Keys controllers, we don't want to redirect
back.

Hi! Before submitting your PR for review, and/or before merging it, please
go through the following checklist:

• For DB changes, check for missing indexes, check to see if the changes
  affect other apps (such as the dashboard), make sure the DB columns in the
  various environments are properly populated, coordinate with devops, plan
  migrations in separate steps.

• For route changes, make sure GET requests don't change state or result in
  destructive behavior. GET requests should only result in information being
  read, not written.

• For encryption changes, make sure it is compatible with data that was
  encrypted with the old code.

• Do not disable Rubocop or Reek offenses unless you are absolutely sure
  they are false positives. If you're not sure how to fix the offense, please
  ask a teammate.

• When reading data, write tests for nil values, empty strings,
  and invalid formats.

• When calling redirect_to in a controller, use _url, not _path.

• When adding user data to the session, use the user_session helper
  instead of the session helper so the data does not persist beyond the user's
  session.

[monfresh]

Using the table in the CSRF documentation I wrote, I verified this works as expected for all LOA1 screens.

[tbaxter-18f]

A second set of eyes wouldn't hurt, but LGTM