Adding parameter_location option to CsrfDoubleSubmitListener

PR adds an optional `parameter_location` configuration value, which allows the listener to check the request's headers for the CSRF token instead of the POST parameters.

No BC break, but I have not, as of yet, written tests covering this use case.