CSRF check supports HEAD method

HEAD method always returns 500 error with CSRF check.
Reporting from user forum. https://groups.google.com/forum/#!topic/play-framework/k6b4X3iqtgg

backport to play 2.3.x.