Exclude /api/v1/login/facebook from CSRF protection

[divad12]

Due to turning on CSRF protection in #63, POSTing to /api/v1/login/facebook from our Android app returns a 403 Forbidden. We need to exclude this endpoint from CSRF protection and have it return the CSRF token.

Also need to ensure this endpoint is a no-op if user is already logged in, else a CSRF attack on this endpoint would allow an attacker to login a user's browser to the attacker's account.