Csrf tokens

[PizieDust]

closes #40
This PR adds functionality for CSRF token.

When a user is authenticated, we use a Double Synchronizer Pattern which keeps the token on the server and transmit a copy as hidden field to the form.

When a user is not authenticated, we use a Naive Double Submit Cookie Pattern which sends the token in a cookie and also a hidden field on the form.

We also add a custom header X-MOLLY-CSRF. Will experiment with this to see if it's better for unauthenticated users than cookies.

[hannesm]

could you rebase on top of the main branch, so the CI failure should go? :)

[hannesm]

Lots of nice additions and refactorings.

I'm still wondering (and that may be because your initial PR comment needs to be updated):

• when is the HTTP header used?
• when is the cookie used?

I guess we need to tackle some other issues (n upcoming refactorings):

• labels and when to use them for function calls
• local bindings vs match ... with
• guard yojson functions in a separate module (for safety reasons, whenever we handle user input, expect the exceptional cases)
• String escaping / cleaning / trimming -- also a potential security issue
• where to store data -- esp. should these csrf tokens really be stored on disk?
• this raises the other question about "which data structure to use" (for e.g. the users)

[hannesm]

(rebased and force-pushed on main)

[hannesm]

IMHO ready to go now

[PizieDust]

Thank you @hannesm.
I'll merge now.