CSRF improvements

* Refactored CSRF handling
* Allowed better script/ajax integration
* Allowed per action CSRF handling
* Fixed BREACH vulnerability
* Added documentation for CSRF
* Made action builders more composable