first implementation of csrf prevention middleware

this implementation uses the "double submit cookies" pattern, but will likely be replaced by a better approach due to cookie insecurities.
modified csrf middleware to use session-stored tokens
csrf middleware can now store the tokens in either the session or a cookie

additionally replaced postParamName, queryParamName and headerName options with
an optional `getToken` function that receives the request as argument and is expected
to return the submitted csrf token.

moved csrf unit tests into own file and allow calling a single test method from commandline.
added strict referrer checking for ssl requests, similar to what django csrf middleware does

csrf throws errors now if requirements are not met
referrer check for ssl requests is now switchable via config property `checkReferrer`
response returned in case of a failed csrf validation is now configurable
renamed getResponse() to getFailureResponse()

bail out of equals() if byte arrays differ in length (performance)
Merge pull request #43 from ringo/csrf

Csrf middleware