Add xsrf.py from head of webapp2_extras

xsrf.py isn't yet in the webapp2 in the SDK, but it's 
in the master branch of webapp2. It's been code reviewed by 
Brian Q and other Googlers. I want to be able to use this
for securing builtin furious handlers.