[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
This makes `:phoenix` dependent on `:crypto`. We need to add it to the list of apps in `mix.exs`.