Rest csrf referer protection

Note: there is a related fts PR: https://bitbucket.org/FoundationDB/akiban-automation/pull-request/117/set-referer-header-if-not-already-set/diff
Given that it's always set explicitly it doesn't seem like we're getting much benefit out of it being enabled here.