When we get bad data, send back bad request
In case of JSON we don't understand... 422

This is a better use case than 406.

422 = Unprocessable Entity
406 = Not Acceptable

406 should only be used if we can't generate content that is acceptable
with the accept the client sent up.
Add helper function for dealing with CSRF tokens
Instead of predicate, we call function ourselves

This is more error prone, and an alternate method needs to be found, but
the predicate didn't give us enough control over what happens next...
Return appropriate JSON when CSRF token fails