Call assoc-double-submit-cookie with request.
Re-order docstring to match arg list.
Make default-error-response and denied-msg standalone.
Refactor existing token check.
Test anti-forgery interceptor.

Provided roughly same coverage as Ring anti-forgery tests, ignoring ones
that didn't seem relevant (e.g., ensuring newlines don't appear in
token). Additional test around 'assoc-double-submit-cookie' fn.