Authenticity token tests

/cc @charliesome @josh @mastahyeti