CSRF protection from cross-origin <script> tags

Extend `protect_from_forgery` to cover GET requests with JavaScript responses, protecting apps from cross-origin `<script>` embedding that may leak sensitive data.

TODO
- [x] Changelog
- [x] Update Security guide
- [x] Test actions that use `Accept` rather than an explicit format
- [x] Test actions that had neither .format nor `Accept`