Omniauth can't cleanup CSRF

In regards to https://github.com/plataformatec/devise/commit/747751a20f50aa8814dcd3eb9a3648f00ab6a707

Perhaps I'm misunderstanding the problem (or approaching the solution incorrectly), but it seems that some OmniAuth functions lose their CSRF token and cause some CSRF errors with forms thereafter. For instance, I work with a growing SOA setup that authenticates via some tokens in session, and the CSRF is reset because of this Warden Hook, causing a number of form issues. I've gotten around in one of the applications by disabling this hook (via the config option) and re-implementing what I've provided here.

These changes allow a Strategy to define `clean_up_csrf?` and set it to false to _not_ reset CSRF after the strategy is run.