Use extension classloader for Play dev mode

Fixes #3420.

By using the extension classloader, rather than the boot classloader, we
can ensure things like Nashorn can be found by Play applications.
Merge pull request #3420 from jroper/3420-ext-classloader

JDK8's Nashorn classes can't be loaded in a Play app during dev
Ensure AddCsrfToken action provides original context

Fixes #3471

Introduced a wrapped context, so calls to mutable objects in the context
such as the session modify the original context, not the new one.
Merge pull request #3471 from jroper/3471-csrf-session

Cannot modify PLAY_SESSION when calling with no cookie and CSRF token is added to session