Add CSRF exercise, refactor for future exercises.

Specific refactorings include a new `passwordStorage` object which abstracts away password storage and any hashing it might involve.