Require Javascript during signup

[markpundsack]

We have a lot of automated account creation abuse. Luckily, so far, the bots don't use Javascript so a simple way to block them would be to somehow require Javascript in the process. This could be challenging to be robust, but I'm sure there's some way to do it. One suggestion would be to have the CSRF token generated/decrypted in javascript.