Don't add CSRF tokens to responses that set cache headers

Adding CSRF tokens to cached responses could lead to users sharing CSRF
tokens if the Play instance is behind a caching proxy, like a CDN.

In this change, a response is determined to be cached if it has a
`Cache-Control` header that does not contain `no-cache`.

The isCached(result) check is in addTokenToResponse() as suggested by
@jroper, this should catch all code paths that might unwisely attempt
to add a token to cached response.

https://github.com/playframework/playframework/pull/3321#discussion_r16579382
Merge pull request #3321 from rtyley/do-not-add-csrf-token-to-cached-responses

CSRFFilter: Don't add CSRF tokens to responses that set cache headers