Add CSFR protection

[Kaliumhexacyanoferrat]

As the operator of a web application, I want the server only to handle state-changing requests issued by legitimate clients.

Example

var protected = Layout.Create().CsfrProtection();

var token = this.FindParent<ICsfrTokenProvider>().Generate();

Acceptance criteria

• The CSFR protection concern will deny all state changing requests without or with an invalid CSFR token
• Handlers can easily generate a CSFR token to be sent to the server
• CSFR protection support is added to all handlers provided by the framework
• The protection is not vulnerable to replay attacks