[data-method] links don't submit the CSRF token

This makes it consistent with jquery-ujs.