Return a 422 when the CSRF token is invalid

At the moment, when the CSRF token is invalid on
a HTTP POST, we acknowledge it by warning in the
logs, but we continue the request. This is a Rails 
default.

Instead, we should explicitly reject the request 
to the user. Rails encourages us to override the
verify_authenticity_token method in the controller
in order to add our own behaviour.
Return a 403 status with a message instead of a 422
Merge pull request #31 from alphagov/reject-unverified-requests

Reject POST requests with an invalid CSRF token