[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
Instead of raising, we could `conn |> put_status(:unauthorized) |> halt` and Logger.debug the error.