Don't create session if there is no session yet.

Requests with no associated session are enabled without any further checks.
More importantly, session is not created in such case.
Updated method names to use positive logic for readability
Updated redirect token logic to only apply the token when redirecting to
a protected page with GET requests protected
Merge pull request #30 from jason-lindquist/resolve_token_leak_on_redirect

Resolve token leak on redirect
Merge pull request #25 from pstibrany/nosession

Don't create session if there is no session yet.
Fixed vulnerable URL parsing algorithm

URL parsing based on string matching was vulnerable to various parsing quirks in browsers. As a result, tokens could leak in links to external domains.
Small fixes
Merge pull request #31 from koto/patch-1

Javascript URL parsing vulnerabilities allowing for token leakage.
Update Owasp.CsrfGuard/conf/Owasp.CsrfGuard.js

ensure coverage of all forms