Don't set the CSRFProtection on GET requests

From the [Rails Security Guide](http://guides.rubyonrails.org/security.html) on CSRF:

> There are many other possibilities, including Ajax to attack the victim in the background. The solution to this is including a security token in **non-GET requests** which check on the server-side.