Better CSRF handling

Instead of nullifying the session (which is the default Rails behaviour), raise
an exception when an unverified request is received.
Merge pull request #1836 from alphagov/csrf-improvement

Better CSRF handling