CSRF Support

This is a first attempt at adding CSRF support. I've modeled the implementation closely after the [Express.js CSRF middleware](https://github.com/expressjs/csurf/blob/master/index.js) and [Django's CSRF middleware](https://github.com/django/django/blob/master/django/middleware/csrf.py).

I preferred some of the subtleties found in Express' version, namely that tokens weren't stored "as-is" in the session cookie, but rather a secret that was used to generate them lazily. Django had some additional strictness with the HTTP referer which I thought was important as well.

Usage is pretty simple. Add ``csrf.CsrfFilter`` to the app's filters (it must come after the ``revel.SessionFilter``), and you're good to go. To add CSRF fields to a form, use the template tag ``{{ csrftoken . }}``. The filter adds a function closure to the ``RenderArgs`` that can pull out the secret and make the token as-needed, caching the value in the request. Ajax support provided through the ``X-CSRFToken`` header.

The ``csrf.RefreshSecret`` should be called after a user logs in.

Like I said, first stab at things. Happy to make/discuss improvements.

Would make more sense if this if statement (line 85) was inside the previous if statement block (line 81). Otherwise it appears like your checking the same thing twice