add csrf
closer to getting references working

some controllers still need to be moved to QE (ex
app/controllers/references_controller.rb,
https://github.com/CruGlobal/si/blob/fe/app/controllers/reference_pages_controller.rb)