3.0 CSRF component

Implement the cookie based CSRF tokens described in #2214. Also remove the csrf features from SecurityComponent. I think this new solution is much much simpler than the old one, easier to read/comprehend and  easier to work with. While the FormHelper tests do not currently run, I did some manual testing to verify that the CSRF component and FormHelper play nice together.

A few questions I had were:

* Should the SecurityComponent add the CsrfComponent as well?
* Should we allow HttpOnly, or Secure only CSRF tokens?