Add configuration: WTF_CSRF_HEADERS

It is convenient to be able to configure the headers that are checked
for CSRF token presence.  Especially when working with existing
frameworks, such as AngularJS, which have built-in support for handling
CSRF/XSRF cookies and tokens.  This commit adds such a configuration
option, preserving the existing two headers (`X-CSRFToken` and
`X-CSRF-Token`) as the default.  Test cases have been added for the
empty and modified configuration option conditions.

See also:
 * https://docs.angularjs.org/api/ng/service/$http
Doesn't this break existing behavior if `csrf_token` is the empty string?

I hope nobody is relying on that behavior, but could this be just `if csrf_token:` instead?