add tests for csrf-protection with http header X-CSRF-TOKEN

Some javascript framework, such as angularjs, use custom HTTP header to pass csrf-token in ajax requests,
and rack-protection could validate csrf-token with http header named X-CSRF-TOKEN.
Padrino should have tests for that feature.