Add csrf tocken to post request that resets mission state.

Resetting mission state doesn't work now because of missing csrf token. This fixes the issue.

Also, resetting mission is broken since the security upgrade, but our tests didn't catch it. Does anyone has any idea how to write tests to cover cases like these? (We probably have to automate the post request in the javascript portion of the code and then see if it succeeded.)