Reevaluate and maybe deprecate custom CsrfProvider

[Guite]

Review whether a custom csrf token manager is needed. If not, deprecate it.

cc @craigh

[Guite]

Our CsrfTokenHandler aims on csrf tokens in GET requests and forms which are not using Symfony forms (yet). So we can get rid of it after 1. all forms use Symfony forms and 2. there are no GET requests anymore changing the state of the system.

From http://security.stackexchange.com/questions/36671/csrf-token-in-get-request

GET requests should also never make state changes to the system,
therefore should not be required to have CSRF protection.
Even logout should not be a GET request for the method
that actually executes the logout (although you could have
a GET link that navigates to another page before
a POST request carries out the action).

[Guite]

I propose that we deprecate it now and trigger deprecation errors to find and eliminate it's usages.
@craigh ?

[Guite]

Also lib/Zikula/Core/Token/* seems to become deprecated in the same step.

[Guite]

Probably our CsrfTokenHandler can be replaced by http://symfony.com/doc/current/controller/csrf_token_validation.html

[Guite]

See also https://stackoverflow.com/questions/12054449/symfony-csrf-and-ajax