Add Host/Origin/Referer validator middleware

[volfpeter]

This is essentially the same as the built-in CSRF protection in Next.js, and is reasonable security with secure, HTTP-only, same-site session cookies.

See the Next.js blog for more info: https://nextjs.org/blog/security-nextjs-server-components-actions

[volfpeter]

CSRF is now discussed in the docs: https://volfpeter.github.io/holm/security/
This issue is now only about adding an optional middleware.