initial changes to introduce WTF
validation mechanism in place for index.html
moved secret key to run.sh
Merge pull request #2 from LandRegistry/adding-WTF

Adding wtf.  And updated CSRF settings, so that they've retrieved from run.sh in development and Heroku when running there.