Disable CSRF form protection if user has ROLE_NO_CSRF_REQUIRED

https://twitter.com/lsmith/status/394742478508527616