Begin implementing CSRF protection.

This works and has tests, but our CSRF cookie is signed with a secret
that's hardcoded in the source code - that needs to be fixed before this
can be deployed.
Move the hard-coded secret key into the config file
Correct a typo in the README
Don't send the CSRF cookie to other pages

Add a path attribute to the CSRF cookie so that browsers only send it to
the redirect_uri page and not to other CKAN pages.

Potentially increases cacheability of pages, and also we may as well not
send our cookie with sensitive data in it unnecessarily.

This is difficult to add a test for so i haven't bothered.