Added CSRF protection + better app errors handling

* we now have an automatic CSRF token check plugged to "$app->before()"
* we use Symfony "Security" components for the token generation and "constant time" token check
* added CSRF token field to our existing forms
* QueryPath HTML hooks management is not triggered anymore when we have an app error