Fix API requests without CSRF token being rejected
CSRF Protection: Don't attempt to catch unused InvalidAuthenticityToken

Rails doesn't raise InvalidAuthenticityToken since 3.0.4

For more information, see
http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/
CSRF Protection: Prevent login CSRF
Merge pull request #1277 from opf/fix/api_csrf_protection

Fix API CSRF Protection and login CSRF
Bump version to 4.0.0pre1

We removed API v1, so the next release will be a major release
according to semantic versioning.
Update CHANGELOG.md
Specs for projects menu visibility
Fix projects menu visibility
Specs for default work package status destroy
Fixed typo which causes wiki pages to fail to load
Merge branch 'release/3.0' into dev
Fix the failing cukes in project_creation_with_type.feature
Translations for default work package status destroy error message
Fix default work package status destroy
Merge pull request #1289 from netfighter/bugfix/7499_no_default_wp_status
Add changelog entry
Merge pull request #1281 from netfighter/bugfix/7531_projects_menu_not_visible