modify CsrfPreventionFilterHttpHeader to work without cookies (needed to work as a web-widget)

(below is doc included in CsrfPreventionFilterHttpHeader.java)

The filter assumes that accesses from client have a HTTP header X-CSRF-TOKEN with value returned with previous 403 request.
This means the first request will always fail, and it is the responsability of the client to resend request with the token.

NB : we do not go the "standard" angular way of setting a cookie since the application is a web-widget,
     which implies the cookie will not be accessible in javascript:
     the cookie would be set for web-widget app foo.com
     whereas the web-widget app will be included in app bar.com which won't have access to foo.com cookies

NB2: it could be much simpler to use jersey's very simple CsrfProtectionFilter
          <param-name>com.sun.jersey.spi.container.ContainerRequestFilters</param-name>
          <param-value>com.sun.jersey.api.container.filter.CsrfProtectionFilter</param-value>
     which checks "X-Requested-By" HTTP header for POST/PUT/DELETE
     but it's not clear wether it is enough
     such HTTP header can only be set using XHR... except when there are bugs
     http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html
     (CSRF: Flash + 307 redirect = Game Over)
     issue fixed long time ago in firefox: 3.5.17, 3.6.14 (http://www.mozilla.org/security/announce/2011/mfsa2011-10.html)
     but what about safari?
     Ruby on Rails and Django have given up the X-Requested-By technique...