First draft of the new CsrfComponent.

This Component will replace the CSRF features in SecurityComponent,
making CSRF protection less of a hassle, simpler to use and more robust.
Merge settings instead of overwriting them.

Merging is far more useful than overwriting as components
can provide useful defaults without having to define fistfuls of
properties.
Start tests for CsrfComponent.
Add detector for PATCH method.
Add valid + invalid tests for CSRF tokens.
Add tests for configuring cookie creation.
Remove most of the CSRF code from SecurityComponent.

The _Token.key data is still around until FormHelper can be updated.
Also store the CSRF token in request->params for easier access.

Because the name of the cookie and field are configurable having
a constant place for the token will be useful.
Update FormHelper to use new CSRF tokens.

I think it works, hard to tell as the FormHelper tests don't actually
run right now.
Remove CSRF token generation from Security Component.

This is now handled by the CSRF Component and doesn't need to be
duplicated here.
Update docs for CsrfComponent.
Add secure flag option for CsrfComponent.
Merge pull request #2285 from markstory/3.0-csrf-component

3.0 CSRF component