Move logging out of middleware and change middleware position

Middleware shouldn't be concerned with logging, and not everybody will
want this lib to spit out logs. Instead we delegate these events to a
listener which can either log these events or ignore them. By default
the events are ignored.

The middlware has also been moved so that it is loaded after the ETag
middlware. If the middleware is before Rack::Cache then:

a) We don't have access to the session, so we can't retrieve the CSRF
   token
b) The original implementation didn't do this
c) Replacing the placeholder after an ETag has been calculated will
   result in the client's browser re-using old authenticity tokens
   across requests, causing users to be logged out

Also moved token generation out of the controller filter as reaching all
the way down to the controller to set CSRF token is just wrong