CSRF protection from cross-origin <script> tags

Thanks to @homakov for sounding the alarm about JSONP-style data leaking
Merge pull request #13345 from jeremy/get-csrf

CSRF protection from cross-origin <script> tags