Anti-forgery for all methods except HEAD and GET
Removed test :reload directive
Using crypto-equality for safe equals function