Add SecureForm implementation for CSRF token.

CRSF secret is stored inside a session which is used together with app
shared secret to generate HMAC signature as a CSRF token. On validation
we will check that both formdata and generated HMAC digest matches.

This implementation is based on WTForms' SessionSecureForm. Temporary
session support is also added using unencrypted cookie store, which is
unsecure and should be changed.