Adds CSRF protection to ApplicationMetalController

Per c1b5c45e2c42c0191ca9f12a2836e31ee1a8de57, this adds forgery protection to
ApplicationMetalController - which is used by TokensController#create. As a result, it is possible
to phish access tokens through the password grant flow on a third party site.


Normally, I believe this is handled by ApplicationController + Rspec out of box - our Metal controller needs to do it explicitly.