Feature to allow middleware to work with CSRF over https

Over https, django csrf middleware compares the HTTP_HOST and the HTTP_REFERER. So even with the corsheaders middleware enabled, csrf checks still fail.

This pull request adds the CORS_REPLACE_HTTPS_REFERER setting, which will replace the HTTP_REFERER header with something that will match HTTP_HOST so django's csrf check succeeds if the cors checks succeed.  

In order that this solution impact the processing pipeline as little as possible, I've also added a small middleware class, CorsPostCsrfMiddleware, that returns request.META to its original state.  This should be added directly after the CSRF middleware is run.