Fixes for the CSRF filter

* Fixes #1734, custom token generator feature reinstatement
* Fixes #1728, ensured CSRFFilter can be instantiated without a running
  application
* Added a csrf.sign.tokens conifguration option to switch between
  default CSRF token providers, either signed or unsigned.
* Abstracted tests so they can be run on many different permutations of
  configuration
* Added documentation about all the different configuration options

This commit breaks binary compatibility, the CSRFFilter constructor
parameters are now not lazy, and CSRFFilter is no longer a case class,
so many of the methods it used to provide are no longer there.  This was
deemed necessary because the intended use of CSRFFilter, ie:

    object Global extends WithFilters(CSRFFilter()) with GlobalSettings

was not possible with the old constructor.  The constructor is however
still source compatible for most use cases.

Since that constructor is intentionally breaking binary compatibility,
new parameters that were added for custom token generation and
configuration signing were added without consideration for binary
compatibility, only source compatibility.