Allow for custom env settings to be set and simple csrf support

Hey @brynary,

How're things?

Helping @rex37 trying to come on board using Padrino we've come across [the need to test out controllers protected from CSRF](https://github.com/padrino/padrino-framework/issues/1016#issuecomment-16298422).

From the [rack-protection specs](https://github.com/rkh/rack-protection/blob/master/spec/authenticity_token_spec.rb#L10-L28) you can tell it's not that hard to do so but it clearly becomes a burden when you have to start setting all of that extra code `{'rack.session' => {:csrf => "b"}, 'HTTP_X_CSRF_TOKEN' => "b"})` for each unsafe method you test.

This PR intends to cover that along by adding a `csrf` helper that allows a user to do something as simple as:

```
before do
  csrf
end
```

and they can forget about csrf management for that test group until they clear it out with `csrf(false)`.

In order to have the validation work fine, I needed two things: a header and a session value. The header was taken care by `header` but I just couldn't find a way of setting the session value across all of the requests.
That is why I implemented an `env` method that allows you to set anything on the env object. I know this might sound risky but in all fairness, whomever is implementing the tests should know how to handle that.
However, there might be another way of doing it that I'm just not aware of.

What do you think about this?
Thanks! :)