Include CSRF tokens by default in every non-GET form. #917.