Prefixing context methods with "ctx".

Name like "setToken()" isn't really clear in this case.
ctxClear()
CSRFHandler now *is* a handler: still only checks safe methods