Make HEAD work / convert to GET once more

While testing a Rails 4 app in semi-production, I noticed that CSRF protection threw exceptions on HEAD requests by crawler bots.

TDLR: Shall I make a pull request that adds support for a HEAD request in the csrf protection code? Should we find a way to convert HEAD -> GET just like in Rails <4.

After discovering, I read in the CHANGELOG that `ActionDispatch::Head` was replaced in favor of `Rack::Head` by Aaron Paterson. `ActionDispatch::Head` converted a HEAD to a GET request like so:

```ruby
    def call(env)
      if env["REQUEST_METHOD"] == "HEAD"
        env["REQUEST_METHOD"] = "GET"
        env["rack.methodoverride.original_method"] = "HEAD"
        status, headers, _ = @app.call(env)
        [status, headers, []]
      else
        @app.call(env)
      end
    end
```

However. `Rack::Head` middleware does not do this HEAD -> GET conversion in https://github.com/rack/rack/blob/master/lib/rack/head.rb.

```ruby
    if env["REQUEST_METHOD"] == "HEAD"
      body.close if body.respond_to? :close
      [status, headers, []]
    else
      [status, headers, body]
    end
```

We could easily add a `request.head?` in `valid_request?` to support this. But somehow I feel there are more reasons and code that depends on HEAD requests being converted to GETs.

Added a failing test for now.