Disabled Csrf hook by default

[grumpydev]

As we haver a mix of people using Nancy for views and services,
and as creating the Csrf cookie is very expensive and validation
of it requires manual work anyway, having it runnign automatically
on every request is wasteful, and is especially harmful with clients
that don't store the cookie (so it gets regenerated every request)

Enabling it is just a single line in the bootstrapp app startup:

Csrf.Enable(pipelines);