Rest csrf referer protection

Note: there is a related fts PR: https://bitbucket.org/FoundationDB/akiban-automation/pull-request/117/set-referer-header-if-not-already-set/diff
It's set in init, not the constructor. I could set it in the constructor, and then fill it in, or set in te constructor, removing the config property from the filter config, which would differ from the way the other filters work.