[WIP] Csrf plug

@josevalim - I saw in Rack that they look for a "HTTP_X_REQUESTED_WITH" header, but JQuery sets a "X-Requested-With" header. Is it correct to look for "x-requested-with" header in Plug?