xsrfhtml: Support key rotation

[empijei]

Currently we only support one key for this plugin, which makes key rotation impossible without disrupting the service.

We should instead accept a set of keys and emit tokens with the latest ones, but validate requests against all keys in the set.