Signed timed csrf - NOT FOR MERGE YET

This is still WIP, but beginning to get close enough for comments.

The main idea is:
1) Use a signed cookie for CSRF
2) If CSRF_TOKEN_MAX_AGE is set, then the token is not the cookie itself, but signed with a future timestamp. In this case the validation of the token makes sure it hasn't expired
3) the csrf_token tag takes arguments; it can take a non-default max-age, and it can output just the token (without the input field) for easier inclusion in scripts (since with age limitation, the scripts can no longer use the value from the cookie)
4) Even when CSRF_TOKEN_MAX_AGE is not set, a specific view can require age limitations. It cannot specify the limit, because that is set at "the other end" (when the token is generated, not validated). This is done via a decorator (that isn't there yet).

Missing, still, are the decorator, tests for the new tag behaviors, and documentation.

Comments welcome.