CSRF Support

This is a first attempt at adding CSRF support. I've modeled the implementation closely after the [Express.js CSRF middleware](https://github.com/expressjs/csurf/blob/master/index.js) and [Django's CSRF middleware](https://github.com/django/django/blob/master/django/middleware/csrf.py).

I preferred some of the subtleties found in Express' version, namely that tokens weren't stored "as-is" in the session cookie, but rather a secret that was used to generate them lazily. Django had some additional strictness with the HTTP referer which I thought was important as well.

Usage is pretty simple. Add ``csrf.CsrfFilter`` to the app's filters (it must come after the ``revel.SessionFilter``), and you're good to go. To add CSRF fields to a form, use the template tag ``{{ csrftoken . }}``. The filter adds a function closure to the ``RenderArgs`` that can pull out the secret and make the token as-needed, caching the value in the request. Ajax support provided through the ``X-CSRFToken`` header.

The ``csrf.RefreshSecret`` should be called after a user logs in.

Like I said, first stab at things. Happy to make/discuss improvements.

At this point the return from function sameOrigin must be true because you checked for it being false on line 69, you should be able to remove the criteria from the if statement