Instead of fetching the CSRF token a single time and caching it in the RobloxAuth struct, we implement a middleware-esque approach where we pass as request factory closure to a custom CsrfTokenStore.send_request function which will call the factory to construct the request, send the request, then extract the CSRF token from the response headers and resend if necessary.

This approach correctly resolves #226 by no longer relying on a deprecated method of receiving a CSRF token.

Additionally, it resolves a long-standing issue of rbx_auth/rbx_api when used in a long-running context where the CSRF token expires. Now, the token will be automatically refreshed and the request retried.

This change does change the public API of both rbx_auth and rbx_api in a very large way, so this PR should not be merged until the docs have been updated as well.