CSRF Support

This is a first attempt at adding CSRF support. I've modeled the implementation closely after the [Express.js CSRF middleware](https://github.com/expressjs/csurf/blob/master/index.js) and [Django's CSRF middleware](https://github.com/django/django/blob/master/django/middleware/csrf.py).

I preferred some of the subtleties found in Express' version, namely that tokens weren't stored "as-is" in the session cookie, but rather a secret that was used to generate them lazily. Django had some additional strictness with the HTTP referer which I thought was important as well.

Usage is pretty simple. Add ``csrf.CsrfFilter`` to the app's filters (it must come after the ``revel.SessionFilter``), and you're good to go. To add CSRF fields to a form, use the template tag ``{{ csrftoken . }}``. The filter adds a function closure to the ``RenderArgs`` that can pull out the secret and make the token as-needed, caching the value in the request. Ajax support provided through the ``X-CSRFToken`` header.

The ``csrf.RefreshSecret`` should be called after a user logs in.

Like I said, first stab at things. Happy to make/discuss improvements.

Yes, but line 69 happens only when the condition on line 55 is true (only if the HTTP method is not safe, like a POST). The check on line 94 always gets called when its either a safe HTTP method (like a GET request), OR the unsafe request passed the previous tests inside the line 55 if statement. The reason the sameOrigin() call is on line 94 is to ensure that tokens aren't leaked in "safe" (like an HTTP GET) cross origin requests, for example if someone built an API that works cross origin.

Like I mentioned though, since the condition is always needed at some point in the filter, it could be move above line 55. I'll do that.