Update 'curl' instructions to cope with the blanket CSRF protection (#31)

```
curl -X POST -H "Csrf-Token: nocheck" -H "Authorization: token {{ YOUR_GITHUB_API_KEY }}" https://gu-who.herokuapp.com/audit/guardian
```

It's enough to add a "Csrf-Token" header with value 'nocheck' to turn off
the CSRF check - because an attacker can not "coerce the browser to set
arbitrary headers, other than the normal headers the browser adds to
requests":

https://www.playframework.com/documentation/2.3.x/ScalaCsrf

Note also that the place to put your API token is different to what we
were previously incorrectly instructing the user.

https://github.com/guardian/gu-who/blob/91b59d3/app/controllers/Application.scala#L112

https://github.com/guardian/gu-who/issues/31