[CSRF links] it should always check for csrf token, not just when _link_token is present in request.

Otherwise, it's too easy to generate CSRF attacks:

Just remove the `_link_token` parameter from the request and you're done!

We should find a way to verify routes that **need** to be checked. 

I see a possibility:

 - mark the request to be **always** checked by adding request attribute `_check_csrf` (via routing for example)


fail here: https://github.com/KnpLabs/KnpRadBundle/blob/develop/EventListener/CsrfListener.php#L23