Validate the authenticity token on POST requests

Without this, the most Rails will do is to log a warning.

Apparently that is a sane default.
Merge pull request #94 from alphagov/reject-unverified-post-requests

Validate the authenticity token on POST requests