Rewrite gem to perform placeholder replacement in Rack middleware

The original after_filter implementation doesn't work if the response is
generated in a before_filter, as rails will not process the action/after
filters.

This also has the side effect of not making the gem rails specific and
in theory this could now be used with sinatra/other rack compatible
frameworks.
Only try and replace the placeholder if the response can be edited, refs #6
Handle cases where response body is enumerable

It seems the rack response body can be an enumerable, or a String...
Insert middleware after ActionDispatch::ParamsParser

Other apps that use middleware (e.g. Devise/Warden) use their own
middleware, and can render pages before lower middlewares can intercept
the response.
Remove calls to response.body

Apparently it's only lower parts of the stack that have access to
response.body
Return the original response if it can't be modified
Ensure that the rack middleware is at the top of the stack, refs #4
Fire log message if token can't be replaced in response, refs #4
Only log if the requested page is an html page, refs #4
Just because body responds to #each does not mean it responds to #map, refs #4
Update reference to old variable in logging statement
Refactor logic in middleware into separate classes
We should only be replacing the token in body of response in range 2XX
Call the app before trying to extract token from session

The app places the token in the session, so extracting it before calling
the app doesn't make any sense
Move logging out of middleware and change middleware position

Middleware shouldn't be concerned with logging, and not everybody will
want this lib to spit out logs. Instead we delegate these events to a
listener which can either log these events or ignore them. By default
the events are ignored.

The middlware has also been moved so that it is loaded after the ETag
middlware. If the middleware is before Rack::Cache then:

a) We don't have access to the session, so we can't retrieve the CSRF
   token
b) The original implementation didn't do this
c) Replacing the placeholder after an ETag has been calculated will
   result in the client's browser re-using old authenticity tokens
   across requests, causing users to be logged out

Also moved token generation out of the controller filter as reaching all
the way down to the controller to set CSRF token is just wrong
Ensure the null listener is loaded by default
Correct variable typo in CheckForTokenInRequest
Only create a CSRF token after the request has finished

* If we create it before the request there's no chance of it being in
  the request payload anyway
* If the user's session is reset during the request then the token we
  generated before request will be invalid