[#4571] only apply set-cookie for csrf protection when serving html pages
[#4571] only apply set-cookie for csrf protection when serving html pages

Only HTML content needs this cookie, since it's used via JS on web forms to
prevent CSRF.  Removing it from all other content (e.g. icons, attachments)
makes those response more cacheable.

apache/incubator-allura,apache/allura,apache/allura,apache/incubator-allura,lym/allura-git,lym/allura-git,heiths/allura,heiths/allura,lym/allura-git,apache/allura,apache/allura,heiths/allura,heiths/allura,apache/incubator-allura,heiths/allura,apache/allura,apache/incubator-allura,lym/allura-git,lym/allura-git