WIP Csrf plug

very rough
@chrismccord  Is `put_session` the right function to use here? I ask because in the tests the value of :csrf_token key in session changes for every conn.