Fixes for the CSRF filter

* Fixes #1734, custom token generator feature reinstatement
* Fixes #1728, ensured CSRFFilter can be instantiated without a running application
* Made token signing optional, so that a custom token generator does not need to generate signed tokens.
* Abstracted tests so they can be run on many different permutations of configuration
* Added documentation about all the different configuration options

This commit breaks binary compatibility, the CSRFFilter constructor parameters are now not lazy, and CSRFFilter is no longer a case class, so many of the methods it used to provide are no longer there.  This was deemed necessary because the intended use of CSRFFilter, ie:

    object Global extends WithFilters(CSRFFilter()) with GlobalSettings

was not possible with the old constructor.  The constructor is however still source compatible for most use cases.

Since that constructor is intentionally breaking binary compatibility, new parameters that were added for custom token generation and configuration signing were added without consideration for binary compatibility, only source compatibility.