Add ability to exclude / include URLs from CSRF protection

[samdark]

Usually the middleware is enabled globally. Need to add a way to exclude certain URLs or include only certain URL.

[samdark]

Related to #12 where we need similar ability but based on authentication.

[vjik]

Hm... maybe this ability should by globaly for any middleware?

[samdark]

Likely not. Many middleware are meant to be attached to router groups/routes, some are alright to be always executed.

[samdark]

Could be achieved now by disabling middleware via router config.