Subclass HTTPBadCSRFToken from HTTPBadRequest and have request.session.check_csrf_token use the new exception.

This supports a more fine-grained exception trapping.
Merge branch 'check_csrf_token' of kpinc/pyramid into feature.bad-csrf-token-exception
move HTTPBadCSRFToken to p.exceptions.BadCSRFToken
update doc references
fix merge conflict
Merge branch 'feature.bad-csrf-token-exception'