FIX: "&" should be escaped to "&amp;"
Some auto-detection for authenticity_token & form_tag

- if the application has protect_from_csrf set to false, do not include authenticity_token
- if :protect_from_csrf => false option is passed to #form_tag, do not include authenticity_token
- defaults to stricter :protect_from_csrf if protection is unknown for safety

Closes #1266
Merge pull request #1320 from Ortuna/csrf_form_tag

Some auto-detection for authenticity_token & form_tag
Merge pull request #1319 from tmtm/fix-escape-ampersand

FIX: "&" should be escaped to "&amp;"
Added some boolean attributes.
Merge pull request #1321 from namusyaka/boolean_attributes

Added some boolean attributes.