Avoid adding multiple CSRF tokens to a URL

[ChristopherSchultz]

The unit tests describe the problem: if a URL already contains a CSRF token and that URL is passed through HttpServletResponse.encode(Redirect)URL, then the URL will end up with multiple instances of a CSRF token.

This patch removes those extra instances should they exist.

[ChristopherSchultz]

There is a bug in this code. For the URL /foo/bar?xcsrf=&xcsrf&xcsrf&xcsrf&xcsrf=abc&xcsrf= it will enter an infinite loop.

[ChristopherSchultz]

It also will incorrectly identify parameters which end with the parameter name (e.g. xcsrf).

[ChristopherSchultz]

All fixed with recent commits. Ready for review.

[rmaucher]

Remove the commented out System.outs ;)

[ChristopherSchultz]

Remove the commented out System.outs ;)

Done!