DI for CSRF filter

The CSRF filter (and other components) should use DI.  If possible, existing zero arg constructors should still work, but I don't think we need to worry about maintaining backwards compatibility if you want to configure it.

The approach:

* The CSRF filter should have three dependencies, a configuration object, a TokenProvider and an ErrorHandler
* A CSRF module should provide bindings for these dependencies and the filter itself
* The module should however not be installed by default, so by default, users will have to add the module to Play via whatever mechanisms we provide for doing that (configuration or programmatic)
* If a user wants to provide a custom CSRF configuration, then rather than including the module, they can provide their own bindings.