Replace custom csrf with ring-anti-forgery

- It's a breaking change. It won't work without wrap-anti-forgery
- A custom error-handler is necessary as the default response from
  ring-anti-forgery don't send a X-CSRF-Token header. Example:
``` clj
(defn custom-error-handler [request]
  {:status 403
   :headers {"Content-Type" "text/html"
             "X-CSRF-Token" *anti-forgery-token*}
   :body "<h1>Missing anti-forgery token</h1>"})

(wrap-anti-forgery {:error-handler custom-error-handler})
```
- Some modifications were necessary because the default response
  is not from castra. So no error handling on the client. I used the
  response status.