Fail WebSocket CSRF check with Forbidden status

Play 2.3 made it possible to return specific results to reject a
WebSocket, rather than just rejecting with an 500 error, so this change
takes advantage of that.

Note though that browsers don't allow you to handle this error in any
way :(.  So in addition to that, I log a warning, in case this does
happen, this will mean users report bugs with the warning, rather than
bugs saying that nothing happened.
Merge pull request #695 from jroper/websocket-forbidden

Fail WebSocket CSRF check with Forbidden status