Allowed Java apps to configure CSRF error handler

It was possible to configure a CSRF error handler per action, but not if
you're using the global CSRFFilter.  This change makes that possible,
via supplying a csrf.error.handler configuration parameter with the
class name of the filter.
Merge pull request #2669 from jroper/csrf-filter-java-error

Allowed Java apps to configure CSRF error handler