use current_app, and _app_ctx_stack

This removes the use of a specific app object from the extension,
instead prefering the `current_app` proxy provided by Flask. This means
that the use of Flask's global `g` (actually meant to be used by users
but not extensions) is necessarily replaced by `_app_ctx_stack`. As a
result, it is now possible to use a single instance of SeaSurf with
multiple Flask application objects. Such an example might be with the
factory pattern.

Additionally a good deal of clean has happened which may not be
backwards compatible, including removal of the helper functions `csrf`
and `xsrf` as well as use of Python's preferred string interpolator,
`format`.

Fixes #44