Moved the CSRF authenticity token to be generated on the form_tag helper

Moved the CSRF authenticity token to be generated on the form_tag helper instead of form_for (the latter uses form_tag at the end anyway...). Added tests too.

@padrino/core-members shouldn't we also add tests for the case where csrf is disabled?

Fixes #1113.