checks for csrftoken cookie and adds X-CSRFToken http header on POST, PUT, and DELETE requests

I know it's not required by a normal server for GET requests, but is there any reason to limit it to only these three request types? I don't think it will it won't hurt anything to put it in all requests.