Ensure that session contains a csrf token after "safe" requests

Currently, `AuthenticityToken#accepts?` will only add an authenticity
token to the session if the request is "unsafe". By default, this means
that the first POST/PUT/DELETE request from every session is guaranteed
to fail[0].

This changeset rearranges a few lines in `AuthenticityToken#accepts?` to
do conditional assignment of `session[:csrf]` every time the method is
called--even for safe requests.

[0]: https://github.com/rkh/rack-protection/issues/60