Add CSRF protection

[scottohara]

Currently the Rails API doesn't do any CSRF checking (i.e. protect_from_forgery), but it should.

This could presumably be done by adding something like:

class ApplicationController < ActionController::API
    include ActionController::RequestForgeryProtection

    before_action :csrf_token_valid?
    after_action :set_csrf_cookie

    protected

    def set_csrf_cookie
      cookies['X-CSRF-Token'] = form_authenticity_token
    end

    def csrf_token_valid?
      Rails.env != 'production' || request.headers['X-CSRF-Token'] === cookies['X-CSRF-Token']
    end
end