R1:95cf83f14ead

Convert some whiny exceptions into quiet MalformedRequest exceptions

Summary:
Fixes T11480. This cleans up the error logs a little by quieting three common errors which are really malformed requests:

- The CSRF error happens when bots hit anything which does write checks.
- The "wrong cookie domain" errors happen when bots try to use the `security.alternate-file-domain` to browse stuff like `/auth/start/`.
- The "no phcid" errors happen when bots try to go through the login flow.

All of these are…