Prepare code for CSRF protection
Refactor code to use CSRF protection
Add CHANGELOG notes
Fix AmazonResourceOwnerTest
Disable CSRF protection by default to prevent potential BC break
To enable it use `options` variable, i.e.:

```
hwi_oauth:
    resource_owners:
        github:
            type:                github
            client_id:           <client_id>
            client_secret:       <client_secret>
            options:
                csrf:            true
Merge pull request #303 from stloyd/feature/csrf

CSRF protection for OAuth2