2.2.0 -- Decouple ajax implementation, simplify CSRF protection

- The mkremote function now accepts another argument, an ajax
  implementation factory function. See #'tailrecursion.castra/jq-ajax
  for an example (this is the default implementation used: jQuery).

- There is apparently no need to generate random CSRF tokens. Since all
  requests must be POSTs we simply require a custom header to be
  supplied with every request (the X-Castra-Csrf header). It doesn't
  really matter what the value associated with the header is. This
  prevents CSRF by eliminating requests made via <form> elements (these
  elements have to way to specify custom headers to send with the
  request). [1]

[1]: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)#POST_scenario
Merge branch 'master' of github.com:tailrecursion/castra

Conflicts:
	project.clj