Enable :except option to :protect_from_csrf.

ref #1258 
I'd suggest to add the :except option to :protect_from_csrf.
This is a way of solving as whitelist.
We can use sinatra's routing path for except option because this was made from Sinatra::Base.
What do you think?

/cc @padrino/core-members @postmodern