Begin implementing CSRF protection.

This works and has tests, but our CSRF cookie is signed with a secret
that's hardcoded in the source code - that needs to be fixed before this
can be deployed.