Improvements to CSRF

* Always set the CSRF token in session
* Use Plug.Crypto.secure_compare/2 to compare tokens
* Rename "authenticity" to "csrf" throughout
* Check for cross-origin regardless of the accept header
Release v0.9.0