Allow can_be_empty to be set on a per-field basis. This is useful for CSRF.

Example:
```php
$form->add("csrf", "input|hidden", Access::csrf_token(), array("can_be_empty" => true));
$form->csrf->add_rule(array("Access::verify_csrf", array(":value")));
```

If no CSRF token is returned in $_POST (illegal access), then load() will keep the pre-filled value in the form (legal access) unless we set can_be_empty to true.