Have Quay always use an OAuth-specific CSRF token

This change ensures that we always store and then check the contents of the OAuth `state` argument against a session-stored CSRF token.

Fixes https://www.pivotaltracker.com/story/show/135803615

endpoints/web.py

@@ -494,7 +494,7 @@ def oauth_local_handler():
 
 
 @web.route('/oauth/denyapp', methods=['POST'])
-@csrf_protect
+@csrf_protect()
 def deny_application():
   if not current_user.is_authenticated:
     abort(401)