Detection of Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimation