Make sure the csrf method is *always* called when GET, HEAD or OPTION. Fixes #303
Make sure the csrf method is *always* called when GET, HEAD or OPTION. Fixes #303

Because it's in there that the csrf token is set, regardless of whether
it's checked.

mlucool/jsbin,jasonsanjose/jsbin-app,KenPowers/jsbin,mingzeke/jsbin,jwdallas/jsbin,martinvd/jsbin,late-warrior/jsbin,mcanthony/jsbin,pandoraui/jsbin,ilyes14/jsbin,eggheadio/jsbin,HeroicEric/jsbin,kirjs/jsbin,thsunmy/jsbin,dennishu001/jsbin,kentcdodds/jsbin,HeroicEric/jsbin,jamez14/jsbin,peterblazejewicz/jsbin,late-warrior/jsbin,Freeformers/jsbin,dhval/jsbin,digideskio/jsbin,remotty/jsbin,arcseldon/jsbin,filamentgroup/jsbin,johnmichel/jsbin,peterblazejewicz/jsbin,jsbin/jsbin,saikota/jsbin,saikota/jsbin,KenPowers/jsbin,mcanthony/jsbin,nitaku/jervis,knpwrs/jsbin,francoisp/jsbin,fgrillo21/NPA-Exam,knpwrs/jsbin,svacha/jsbin,Hamcha/jsbin,vipulnsward/jsbin,simonThiele/jsbin,y3sh/jsbin-fork,filamentgroup/jsbin,yize/jsbin,yize/jsbin,IvanSanchez/jsbin,knpwrs/jsbin,IveWong/jsbin,ctide/jsbin,fend-classroom/jsbin,kirjs/jsbin,juliankrispel/jsbin,juliankrispel/jsbin,AverageMarcus/jsbin,jamez14/jsbin,blesh/jsbin,ilyes14/jsbin,mingzeke/jsbin,dedalik/jsbin,jsbin/jsbin,Hamcha/jsbin,kentcdodds/jsbin,KenPowers/jsbin,eggheadio/jsbin,thsunmy/jsbin,martinvd/jsbin,dennishu001/jsbin,carolineartz/jsbin,y3sh/jsbin-fork,minwe/jsbin,pandoraui/jsbin,fgrillo21/NPA-Exam,roman01la/jsbin,ctide/jsbin,vipulnsward/jsbin,minwe/jsbin,francoisp/jsbin,AverageMarcus/jsbin,simonThiele/jsbin,roman01la/jsbin,yohanboniface/jsbin,dedalik/jsbin,dhval/jsbin,digideskio/jsbin,mdo/jsbin,Freeformers/jsbin,svacha/jsbin,carolineartz/jsbin,fend-classroom/jsbin,IvanSanchez/jsbin,jwdallas/jsbin,johnmichel/jsbin,mlucool/jsbin,yohanboniface/jsbin,jasonsanjose/jsbin-app,arcseldon/jsbin,IveWong/jsbin