ref(controller): disable CSRF token authn/authz
ref(controller): switch to token-based authn

When pulling out CSRF tokens from the authentication requirements, we
are still relying on cookies. This is great from a CSRF attacker's
standpoint as attackers can easily `<iframe>` the site that utilizes the
API, generate a POST request and re-use the existing cookie. Using
token-based authn fixes this because there will be no existing authn
cookie in the request. With this change, we are also not vulnerable to
XSRF attacks either because we do not store a validated login cookie
in the browser (yay!).
test(integration): add client.json tests
Merge pull request #2136 from bacongobbler/remove_csrf_token

ref(controller): remove csrf token; switch to token-based authn