create simplate to receive callbacks from Balanced

fixes #1811
add first test for balanced-callbacks.spt
disable CSRF check for `/balanced-callbacks`
fix `csrf.inbound` hook

The `except KeyError:` block was never executed since we were using `.get()`, which doesn't raise `KeyError` but returns `None` instead.
test that a CSRF token isn't required
add another test