added support for CSRF in HTTP headers
added sinon for spying/stubbing during unit tests
updated security_test.js
added check for req.headers ... for unit testing with empty object
Merge pull request #616 from JohnnyEstilles/feature/csrf-in-http-headers

Added support for CSRF in HTTP headers