[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
This is assuming the session was previously fetched. Is this assumption ok? Should we fetch automatically or should we document the user must do so? Given Phoenix fetches the session automatically, I would go with assume the session was previously fetched and explicitly document it (in the moduledoc).