Add CSRF protection for AJAX calls

Without this setup, $.ajax POSTs and DELETEs fail.
Register and cancel from event page via AJAX

I extracted the RSVP markup into a partial so it can be rendered and
returned as the response from the register and unregister views.

The workflow for making an AJAX request and replacing content with the
response was not specific to event registration, so I implemented a
reusable fetchAndReplace function.
Merge pull request #162 from azavea/feature/jcw/rsvp-from-event-detail

RSVP from event detail page