Allowed Java apps to configure CSRF error handler

It was possible to configure a CSRF error handler per action, but not if you're using the global CSRFFilter.  This change makes that possible, via supplying a csrf.error.handler configuration parameter with the class name of the filter.