Validate the authenticity token on POST requests

Without this, the most Rails will do is to log a warning.

Apparently that is a sane default.