CSRF protection in card update

Inject a custom header into the update card request to ensure that this is not a CSRF attack. Play supports the `Csrf-Token` header by default (https://www.playframework.com/documentation/2.3.x/ScalaCsrf).