[TAV-432] Fix CSRF bug in interactions.

When replying to an interaction we need to supply the csrf-token in the request
headers so that Rails can satisfy itself that we're not doing something naughty.
If this isn't passed then it silently complains but the authentication system,
such as Devise, might act on it and kill the current user session.