CSRF improvements

* Refactored CSRF handling
* Allowed better script/ajax integration
* Allowed per action CSRF handling
* Fixed BREACH vulnerability
* Added documentation for CSRF
* Made action builders more composable
Merge pull request #1508 from jroper/csrf-refactor

CSRF improvements