Better CSRF handling

Instead of nullifying the session (which is the default Rails behaviour), raise
an exception when an unverified request is received.