Merge pull request #26 from alanhamlett/master

remove secret from hashed cookie value
allow cross-domain ajax over https

for more info see https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Access-Control-Allow-Origin

also, allowed setting custom name for the http header.
incrementing version
Fixed exception in the case where _csrf_token is not available in Flask.g
Merge pull request #28 from jgelens/master

Fixed exception in the case where _csrf_token is not available in Flask.g
version 0.1.15
Merge pull request #27 from ryankshaw/patch-1

allow cross-domain ajax over https
version 0.1.16
Remove Jinja2 dependency by always setting the CSRF token if the request's endpoint should be protected.
version 0.1.17
removing docs/_build
dropping Python 2.5 support
adding theme submodule
updating docs to include flask-wtforms example, thanks @DanDoesCode
updating metadata and version string
using werkzeug.security for constant-time compare
version 0.1.18
updating Travis build status link