Explicitly enable CSRF handler

This used to be enabled by default in tangled.web.
Add [wsgi_application] buildout part

Generates WSGI application file for use in production.