Added option for :protect_from_csrf => false on form_tag

- Changed existing tests so they don't have false positives with these new options
- should close #1266 if accepted