bad csrf token exception

Replaces #1149 by making `BadCSRFToken` a top-level exception in `pyramid.exceptions`.