Apply CSRF token to all request headers from the angular app on locations.  Also reinstated the standard verify_authenticity_token check.  Will need to figure out how to make this global.