create simplate to receive callbacks from Balanced

fixes #1811
add first test for balanced-callbacks.spt
disable CSRF check for `/balanced-callbacks`
fix `csrf.inbound` hook

The `except KeyError:` block was never executed since we were using `.get()`, which doesn't raise `KeyError` but returns `None` instead.
test that a CSRF token isn't required
add another test
www/balanced-callbacks.spt → www/callbacks/balanced.spt
Merge pull request #2620 from gittip/record-ach-failures

Record credit failures