Fully migrate API security tests into the pytest test suite

Also adds an additional test that ensures that at least one security test exists for every (api endpoint, http method) pair.

endpoints/test/shared.py

@@ -14,11 +14,11 @@ CSRF_TOKEN = '123csrfforme'
 @contextmanager
 def client_with_identity(auth_username, client):
   with client.session_transaction() as sess:
+    sess[CSRF_TOKEN_KEY] = CSRF_TOKEN
     if auth_username and auth_username is not None:
       loaded = model.user.get_user(auth_username)
       sess['user_id'] = loaded.uuid
       sess['login_time'] = datetime.datetime.now()
-      sess[CSRF_TOKEN_KEY] = CSRF_TOKEN
     else:
       sess['user_id'] = 'anonymous'