Location creation works again.

* Implemented Angular's special XSRF-TOKEN session cookie to protect against CSRF
* Using strong_parameters to create/update locations.