Add CSRF protection decorator
Set template rendering to be html escaped by def.

  * Reorganize code slightly (may still change)
  * Change helper functions to return HTMLLiterals
Change escaping behaviors at form level

* Additionally remove html escapes in stack trace
Cleanup PEP8 code
Bump rev to 0.3.0