Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
We shouldn't raise an error. Instead we should halt the connection or clear the session and continue. Maybe `halt: true` ? Personally, I'm for always halting until someone needs/wants the ability for the stack to continue. The safest approach is to halt always. So maybe we do away with an option entirely for now.