implemented error message for js disabled on client side

#Modification: An error message will be shown to user if js is disabled
in client side, as CSRFProtector cannot work without js.  The error
message shown will be configurable, and can be changed by editing
`disabledJavascriptMessage` in config file