Switch to capybara based integration test, instead of hpricot/net-http/unicorn

This makes the integration test suite much cleaner and less
brittle.
Add CSRF protection via rack_csrf

Other minor changes while here:

Don't create a secret file automatically, make the user create one.

Fix a minor style issue.
Fix error if no secret file, and allow secret to be set by environment