On Fragile Features and Batch Normalization in Adversarial Training