Always Print CSRF token with form_open() unless `get` method

I prefer to do csrf verification inside my controller / method with `$this->security->csrf_verify()`. Reason, while setting the non-csrf uris in ``csrf_exclude_uris`` works, placing in the controller/method gives me better idea on what the controller / method doing, plus I can set more precisely where I want to check for CSRF incase I dont want all $_POST requests to check with CSRF.

So mainly I'm doing csrf verification when required instead of global csrf checking.

This PR is Backward Compatible, so if `csrf_protection` is set to TRUE, it will work like expected.