Add configuration: WTF_CSRF_HEADERS

It is convenient to be able to configure the headers that are checked
for CSRF token presence.  Especially when working with existing
frameworks, such as AngularJS, which have built-in support for handling
CSRF/XSRF cookies and tokens.  This commit adds such a configuration
option, preserving the existing two headers (`X-CSRFToken` and
`X-CSRF-Token`) as the default.  Test cases have been added for the
empty and modified configuration option conditions.

See also:
 * https://docs.angularjs.org/api/ng/service/$http
`if` should be outdented of `for`.