Rest csrf referer protection

Note: there is a related fts PR: https://bitbucket.org/FoundationDB/akiban-automation/pull-request/117/set-referer-header-if-not-already-set/diff
what about `http://test.test` ?