Fixed EZP-19971 - Forms from 5.x to LS stack not supported by ezformtoken

`response/output` legacy filter was not triggered in Location/Content/BlockViewProvider services.

Also deactivates CSRF protection in legacy when it's deactivated in `config.yml`.

See:
* https://github.com/ezsystems/ezpublish-legacy/pull/616
* https://github.com/ezsystems/ezpublish-community/pull/47