use double-cookie csrf protection

test plan:
* in one tab, start to fill out an ajax form
 (e.g. editing a quiz)
* in another tab, log out of canvas
* return to the original tab and try to
 submit the form (e.g. save your changes)
* should get an error message with a link to
 login in a new tab
* login in the new tab
* return to the original, and try to resubmit
* should save successfully

closes #CNVS-3957 #CNVS-13673

Change-Id: I7758514de8ce09361fef469034645d8a29e2a5e5
Reviewed-on: https://gerrit.instructure.com/40396
Reviewed-by: Jacob Fugal <jacob@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cosme Salazar <cosme@instructure.com>