add report_csrf_failure, enable custom reports

[ujifgc]

ref #1566

To render custom error add to your app

enable :protect_from_csrf
enable :report_csrf_failure
error 403 do
  render 'base/error'
end

[dariocravero]

Thanks @ujifgc! Looks good to me. @skade, thoughts?

[skade]

I would prefer if the old key still worked with a warning, for those that configured it.

Just to validate: The current solution doesn't short-circuit in the middleware stack, but instead halts in the routing layer by adding a condition to all routes that halts by default? Seems good to me.

The previous version stemmed from the fact that I tried to keep as close to Rack::Protection standard behaviour as possible.

[ujifgc]

As the default behavior now to bubble 403 up to Sinatra do you see any point to watch after this allow_disabled_csrf? Would anyone disable allow_disabled_csrf manually? I added a deprecation notice.

[ujifgc]

I reverted enabling report_csrf_failure by default and removed deprecation of enabled allow_disabled_csrf. Also improved tests to ensure custom errors are working.