It's not working as expected when paired with nosurf

[sam0737]

It is broken when used with https://github.com/justinas/nosurf/ because...

1. If token failed to validate, and 400 response has been written, the handler chain is not stopped which defeat the purpose.
2. nosurf replaced the request with key embedded in context value, and such the original request must be replaced. Otherwise there is no way to get the token out in the handler and place it in HTML tag or alike.

Here is my fix attempt: justinas/nosurf#30 (comment)