Rest csrf referer protection

Note: there is a related fts PR: https://bitbucket.org/FoundationDB/akiban-automation/pull-request/117/set-referer-header-if-not-already-set/diff
Was http*s* intended?