Add options to add csrf token to handles() and resources() url generator.

Signed-off-by: crynobone <crynobone@gmail.com>
Update testcase.

Signed-off-by: crynobone <crynobone@gmail.com>