protectFromForgery() and 'GET's that are X-AJAX or X-PJAX requests