Added a test that shows that a HEAD request does not normally pass CSRF protection
Added request.head? to forgery protection code
Merge pull request #9032 from firmhouse/head-breaks-csrf

Make HEAD work / convert to GET once more
explains why the query cache checks arel.locked
updates a dynamic method heredoc doc