CSRF protection from cross-origin <script> tags

Extend `protect_from_forgery` to cover GET requests with JavaScript responses, protecting apps from cross-origin <script> embedding that may leak sensitive data.

TODO
[ ] Update Security guide
[ ] Changelog