Extend \`protect_from_forgery\` to GET requests with JavaScript responses,