Added a couple options to the csrf api

Now an entry point can be defined (where a user-submitted value is not yet required) and the methods to ignore can be specified (while they still default to 'GET', 'HEAD', and 'OPTIONS'). E.g.:

var options = {
  value: function defaultValue(req) {
    return req.headers['x-csrf-token'];
  },
  methodIgnoreList: ['OPTIONS'],
  entryPoint: {
    path: '/sessions',
    method: 'POST'
  }
};