Fix CSRF token authenticity for rewards controller