Add csrf_token() to Jinja2 globals

Installing csrf_token() in the render context only causes errors in
imported Jinja2 templates. It can be avoided by explicitly importing
templates with context, but it is a cognitive burden to remember which
templates should be imported with context and which don't have to be.
Avoid timing attack on csrf validation with `hmac.compare_digest`.
This method is only available since CPython 2.7.7 and 3.3.

Related issue: https://github.com/lepture/flask-wtf/issues/130
csrf exempt supports Flask Blueprint now.

Related issue: https://github.com/lepture/flask-wtf/issues/111
Test cases on exempt blueprint
Merge #118 Add csrf_token() to Jinja2 globals