Ensure that session contains a csrf token after "safe" requests

Currently, `AuthenticityToken#accepts?` will only add an authenticity
token to the session if the request is "unsafe". By default, this means
that the first POST/PUT/DELETE request from every session is guaranteed
to fail. (see: https://github.com/rkh/rack-protection/issues/60)

This changeset rearranges a few lines in `AuthenticityToken#accepts?` to
do conditional assignment of `session[:csrf]` every time the method is
called--even for safe requests.
spec only cares about presence of csrf token, not length