move /csrf to /wsapi/csrf. add /wsapi path to cookies, as all other requests...

move /csrf to /wsapi/csrf.  add /wsapi path to cookies, as all other requests should have aggressive cache headers.  Only create a csrf token when the client asks for it.  issue #173