remove allow_disabled_csrf, add report_csrf_failure, enable bubbling
add deprecation notice for allow_disabled_csrf
mimic rack-protection when no error handler defined, revert default reporting
Merge pull request #1573 from padrino/clarify-csrf

add report_csrf_failure, enable custom reports