Update csrf_helper.rb (KISS)

i want to propose a breaking change to make naming convention simpler. 
I never saw people to modify `request_forgery_protection_token`. Look at this code:
```
 form_authenticity_token == params[request_forgery_protection_token] ||
          form_authenticity_token == request.headers['X-CSRF-Token']
```
Why param's name is variable but header name is constant? And, why default name is 'authenticity_token'? (In fact CSRF is about authorization, not authentication. So, this naming sucks).

I propose to have X-CSRF-Token and csrf_token as constant names for CSRF token. Yes, completely constant in code. Such things are never modified. 

It is a speaking name and developers will understand what does it exactly do. I never understood where is "authenticity" part in authenticity_token.

p.s. PR is not done, what do you think?