[CSRF links] it should always check for csrf token, not just when _link_token is present in request.

Otherwise, it's too easy to generate CSRF attacks:

Just remove the `_link_token` parameter from the request and you're done!

We should find a way to verify routes that **need** to be checked. 

I see a possibility:

 - mark the request to be **always** checked by adding request attribute `_check_csrf` (via routing for example)


fail here: https://github.com/KnpLabs/KnpRadBundle/blob/develop/EventListener/CsrfListener.php#L23


## Solution:

``` yaml
homepage:
    pattern: /
    defaults:
        _controller: FrameworkBundle:Template:template
        template: 'App::homepage.html.twig'
        _check_csrf: false

```