Add examples to narrative CSRF docs
Update tests to use X-CSRF-Token header