Clicking on asset produces 422 error

[mbakeryo]

When I try to go to an asset, I get a 422 - The change you wanted was rejected error message.

Steps to reproduce 1) go to https://heliotrope-preview.hydra.lib.umich.edu/northwestern 2) click the Book title link 3) you'll get a 422.

[conorom]

I, [2018-02-26T09:32:54.724276 #13907]  INFO -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] Started POST "/catalog/tm70mv23c/track?counter=3&locale=en&search_id=28600" for 141.213.175.85 at 2018-02-26 09:32:54 -0500
I, [2018-02-26T09:32:54.727168 #13907]  INFO -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] Processing by CatalogController#track as HTML
I, [2018-02-26T09:32:54.727286 #13907]  INFO -- : [b100b90b-55e6-4867-9b49-3dd0e266300f]   Parameters: {"authenticity_token"=>"u55uxKexKBFKkMyPSa9IMNZseiJAr4X+NXlzjX8XrH9zmaeaABLkRyXlOBKwrxBCFKHmzHIcBMPHbVm55B4wxQ==", "redirect"=>"/concern/file_sets/tm70mv23c?locale=en", "counter"=>"3", "locale"=>"en", "search_id"=>"28600", "id"=>"tm70mv23c"}
W, [2018-02-26T09:32:54.728944 #13907]  WARN -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] Can't verify CSRF token authenticity.
I, [2018-02-26T09:32:54.729640 #13907]  INFO -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] Completed 422 Unprocessable Entity in 2ms (ActiveRecord: 0.0ms)
F, [2018-02-26T09:32:54.731918 #13907] FATAL -- : [b100b90b-55e6-4867-9b49-3dd0e266300f]
F, [2018-02-26T09:32:54.732010 #13907] FATAL -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
F, [2018-02-26T09:32:54.732127 #13907] FATAL -- : [b100b90b-55e6-4867-9b49-3dd0e266300f]
F, [2018-02-26T09:32:54.732254 #13907] FATAL -- : [b100b90b-55e6-4867-9b49-3dd0e266300f] actionpack (5.1.4) lib/action_controller/metal/request_forgery_protection.rb:195:in `handle_unverified_request'
[b100b90b-55e6-4867-9b49-3dd0e266300f] actionpack (5.1.4) lib/action_controller/metal/request_forgery_protection.rb:227:in `handle_unverified_request'
[b100b90b-55e6-4867-9b49-3dd0e266300f] devise (4.3.0) lib/devise/controllers/helpers.rb:253:in `handle_unverified_request'
[b100b90b-55e6-4867-9b49-3dd0e266300f] actionpack (5.1.4) lib/action_controller/metal/request_forgery_protection.rb:222:in `verify_authenticity_token'

[conorom]

I tried a quick change to protect_from_forgery based on the Rails 5 default behavior suggested by user "boone" here. This didn't fix it but led me to find the possibly-related Hyrax issue:
heartcombo/devise#4085
samvera/hyrax#1191