Validate the authenticity token on POST requests

Without this, the most Rails will do is to log a warning, which means that we are theoretically vulnerable to a [CSRF attack](http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf).

Shamelessly copied from https://github.com/alphagov/maslow/pull/31