Fix: add a CSRF check when linking an account.

See https://github.com/artsy/force/pull/1691 for details.

Tests are proving themselves a bit tedious ...