Send the quiz unload beacon's CSRF token in the body

The quiz auto-submit beacon sends its CSRF token in the request body instead of the URL, so the token no longer lands in proxy access logs.