Add configuration: WTF_CSRF_HEADERS

It is convenient to be able to configure the headers that are checked
for CSRF token presence.  Especially when working with existing
frameworks, such as AngularJS, which have built-in support for handling
CSRF/XSRF cookies and tokens.  This commit adds such a configuration
option, preserving the existing two headers (`X-CSRFToken` and
`X-CSRF-Token`) as the default.  Test cases have been added for the
empty and modified configuration option conditions.

See also:
 * https://docs.angularjs.org/api/ng/service/$http
The `break` keyword here applies strictly in the loop context which is what `if` is indented of `for`.

What I am trying to do is keep the existing logic without having multiple conditionals. If `csrf_token` is already set the first time through the loop, iteration will be broken and the existing value will be used. Otherwise the first HTTP header to be present and contain a value will be used. This is how the logic works now in `master`.

If other logic was intended I'm happy to make whatever changes are required.