Fix API requests without CSRF token being rejected
CSRF Protection: Don't attempt to catch unused InvalidAuthenticityToken

Rails doesn't raise InvalidAuthenticityToken since 3.0.4

For more information, see
http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/
CSRF Protection: Prevent login CSRF
Merge pull request #1277 from opf/fix/api_csrf_protection

Fix API CSRF Protection and login CSRF
Bump version to 4.0.0pre1

We removed API v1, so the next release will be a major release
according to semantic versioning.
Update CHANGELOG.md