Mitigate CSRF bypassing Same Origin Policy attack

See:

* http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4671
* https://github.com/symfony/symfony/pull/11367