hidden_tag does not work as expected

[pyx]

As of version 0.3.0, I changed hidden_tag into more in line with Flask-WTF's, which includes all hidden tags in addition to the csrf_token. This sounds good except I did not wrap the whole thing inside Markup and returned a string directly, which broke the API.

In stead of having yet another dependency (markupsafe), I am planning to remove property hidden_tag, the token will still be accessible as form.csrf_token or whatever name user set in configuration anyway. I may add it back later on if there will be strong demand.