Backport authenticity_token parameter for form_for

Allow authenticity token to be omitted for external requests
Merge pull request #10 from github/backport_form_for_authenticity_token

Backport authenticity_token parameter for form_for