csrf: the shared same-origin guard

Five services carried their own copy of the Origin/Referer check and the
copies had drifted, not only in wording: tokens, cover and bench apply it
as router-wide middleware, while dolt and specs call a predicate from
individual handlers, so a form added to either of those goes out
unguarded. Require is therefore the API this package leads with, and
SameOrigin is the escape hatch for a service migrating one route at a
time.