2.0.0 -- change header names; bugfixes

- Change header names from things like 'X-Tunnel' to 'X-Castra-Tunnel'
  to avoid collisions. This may impact integration with other ring
  middleware, most likely when code relied on castra setting the
  'X-Csrf' attribute, now renamed to 'X-Castra-Csrf'.

- Fix race condition setting csrf token when multiple requests are
  sent before the first response is handled in the client.