Fix EZP-21270: The CSRF token is passed in header in GET request
!squash
- adding more safe methods