Cdodge/fix cors csrf

@antoviaque can you look at this?

Also, I don't believe this has been merged up to edx/edx-platform? Do you need to cherry pick this onto any open PR?