Allow updates just with auth token

Rails usually requires an additional CSRF protection token but when it's
not present we ignore the user's session and use only the OIDC auth
token.

engines/dfc_provider/app/controllers/dfc_provider/base_controller.rb

@@ -3,6 +3,8 @@
 # Controller used to provide the API products for the DFC application
 module DfcProvider
   class BaseController < ActionController::Base
+    protect_from_forgery with: :null_session
+
     rescue_from ActiveRecord::RecordNotFound, with: :not_found
 
     before_action :check_authorization