CSRF Support

This is a first attempt at adding CSRF support. I've modeled the implementation closely after the [Express.js CSRF middleware](https://github.com/expressjs/csurf/blob/master/index.js) and [Django's CSRF middleware](https://github.com/django/django/blob/master/django/middleware/csrf.py).

I preferred some of the subtleties found in Express' version, namely that tokens weren't stored "as-is" in the session cookie, but rather a secret that was used to generate them lazily. Django had some additional strictness with the HTTP referer which I thought was important as well.

Usage is pretty simple. Add ``csrf.CsrfFilter`` to the app's filters (it must come after the ``revel.SessionFilter``), and you're good to go. To add CSRF fields to a form, use the template tag ``{{ csrftoken . }}``. The filter adds a function closure to the ``RenderArgs`` that can pull out the secret and make the token as-needed, caching the value in the request. Ajax support provided through the ``X-CSRFToken`` header.

The ``csrf.RefreshSecret`` should be called after a user logs in.

Like I said, first stab at things. Happy to make/discuss improvements.

@anonx yes, if the token wasn't sent in the form (right?).