CSRF attack prevention middleware (partial)

It's partial because it lacks session support at the moment. Errors get thrown when I try to apply session functions from within the middleware extension.

I accidentally pushed the wrong emacs buffer 3 times, so please ignore the first 3.
Lines 21-40 & Line 112 at https://github.com/runexec/lib-noir/blob/e1fbc81be96117d033ca75c449b08dff79860d03/src/noir/util/middleware.clj