Include application/javascript when checking content_type

Was looking at the code in request_forgery_protection and noticed that we check for only the `text/javascript` content type. Since `application/javascript` is now the official javascript MIME type (http://stackoverflow.com/questions/189850/what-is-the-javascript-mime-type-what-belongs-in-the-type-attribute-of-a-script), thought it would be good to include `application/javascript` when checking for content-type in #non_xhr_javascript_response?.

Let me know if there's anything I could do to improve. Thanks in advance!