Improve BAD CSRF error message when making API calls with content-type application/json

[nylen (James Nylen)]

We were seeing this error after a recent Discourse upgrade (within the last few months). The application was not authenticating against the API via the HTTP headers, changed it to do so and now it works again.