Add configuration: WTF_CSRF_HEADERS

It is convenient to be able to configure the headers that are checked
for CSRF token presence.  Especially when working with existing
frameworks, such as AngularJS, which have built-in support for handling
CSRF/XSRF cookies and tokens.  This commit adds such a configuration
option, preserving the existing two headers (`X-CSRFToken` and
`X-CSRF-Token`) as the default.  Test cases have been added for the
empty and modified configuration option conditions.

See also:
 * https://docs.angularjs.org/api/ng/service/$http
Indeed it does. The change is probably me reading too much into the intentions of the original implementation.

Having this be just `if csrf_token:` is obviously trivial. If that's desired I'm happy to do it, document the implementation details and write tests to enforce them.