Added a couple options to the CSRF API

Now an entry point can be defined (where a user-submitted value is not yet required) and the methods to ignore can be specified (while they still default to 'GET', 'HEAD', and 'OPTIONS'). E.g.:

    var options = {
        value: function defaultValue(req) {
            return req.headers['x-csrf-token'];
        },
        methodIgnoreList: ['OPTIONS'],
        entryPoint: {
            path: '/sessions',
            method: 'POST'
        }
    };