Some auto-detection for authenticity_token & form_tag

- if the application has protect_from_csrf set to false, do not include authenticity_token
- if :protect_from_csrf => false option is passed to #form_tag, do not include authenticity_token
- defaults to stricter :protect_from_csrf if protection is unknown for safety

Closes #1266