Add CSRF option validation cookie-to-header

Checking CSRF attempt using javascript same origin policy security feature

http://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-Header_Token

Default value is false