Following changes are made to support configuration per tenant.
(1) Moved the SingletonHolder into a new class CsrfGuardSingletonInstance, which implements a new interface CsrfGuardInstanceProvider.
(2) The CsrfGuard class still statically initializes itself with the CsrfGuardSingletonInstance, BUT we now have a way to inject our own CsrfGuardInstanceProvider implementation via a new static setter method.
(3) The CsrfGuard.load() now takes instance to be initialized as a parameter, and the context listener code is updated to pass this.