CSRF: Move isCached(result) check to addTokenToResponse()

As suggested by @jroper, this should catch all code paths that might
unwisely attempt to add a token to cached response.

https://github.com/playframework/playframework/pull/3321#discussion_r16579382