Update mangler for modern setuptools
Always use utcnow, not now

The protector uses utc.

Without these changes the tests fail in Britain during
the summer.
Support unicode usernames in csrf tokens.

The trick here is to encode them, as is done with the tiddlyweb_user
cookies. However, care must be taken because the csrf_token in a form
submission will be decoded during query processing. To accomodate this
we encoded it back...

There's a good deal of duplication in the tests now. It was already
there, but these changes make it more obvious.
release 0.5.0