Add CSRF to instructions form

[ozten]

We don't need this for MVP because:

• You have to be signed in via Persona
• You must be signed in as an email address that has been invited
• Your request must be a POST