Add experimental CSRF Token support

Adds a middleware (cowboy_csrf) to parse options - see
cowboy_csrf:env_option(). The middleware should be placed before any
other middlewares or handlers that use the api.

Adds functions to create/retrieve token information:
 * cowboy_csrf:token_qs(Req) -> {{QsKey, Token}, Req2}
 * cowboy_csrf:token(Req) -> {{HeaderName, Token}, Req2}
The former is used to get a Key, Value pair to add to a urlencoded form.
The later to get the required header for use with other body types.
A cowboy_cookie_session cookie will automatically be added to the
response headers in Req2.

When reading the body in a handler or middleware the following functions
must be called using the cowboy_csrf module instead of cowboy_req:
 * stream_body/1,2
 * body/1,2
 * multipart_data/1
The functions are identical to their cowboy_req counterparts except they
may also return {error, csrf}. The rest of the cowboy_req body api is
also provided in cowboy_csrf.