rebased CORS_REPLACE_HTTPS_REFERER pull request

This is the rebased pull request for csrf and cors over https

Over https, django csrf middleware compares the HTTP_HOST and the HTTP_REFERER. So even with the corsheaders middleware enabled, csrf checks still fail.

This pull request adds the CORS_REPLACE_HTTPS_REFERER setting, which will replace the HTTP_REFERER header with something that will match HTTP_HOST so django's csrf check succeeds if the cors checks succeed.

In order that this solution impact the processing pipeline as little as possible, I've also added a small middleware class, CorsPostCsrfMiddleware, that returns request.META to its original state. This should be added directly after the CSRF middleware is run.