add _check_csrf option to enable verification
Merge pull request #83 from KnpLabs/bugfix/83-csrf-check-option

[CSRF links] it should always check for csrf token, not just when _link_token is present in request.