Reject POST requests with an invalid CSRF token

At the moment, when the CSRF token is invalid on a non-GET request, we acknowledge it by warning in the
logs, but we continue the request. This is a Rails default.

Instead, we should explicitly reject the request to the user. Rails encourages us to override the `verify_authenticity_token` method in the controller in order to add our own behaviour.

This changes Maslow to return a HTTP 403 status, with an "Invalid authenticity token" message.