Added a test that shows that a HEAD request does not normally pass CSRF protection
Added request.head? to forgery protection code
Merge pull request #9032 from firmhouse/head-breaks-csrf

Make HEAD work / convert to GET once more