Refactoring CSRF implementation

Changes a few things in CSRF:

- It drops the express/connect dependency for a custom one
- Allows customization of CSRF key name in `res.locals`
- Allows for a custom token creation/validation implementation
- Adds a few test cases
- Misc other cleanup in the licenses, docs, and all around

The default implementation for creating and validating tokens is similar to the algorithm connect uses, but I'm looking for feedback on that.