Don't add CSRF tokens to responses that set cache headers

Adding CSRF tokens to cached responses could lead to users sharing CSRF
tokens if the Play instance is behind a caching proxy, like a CDN.

In this change, a response is determined to be cached if it has a
`Cache-Control` header that does not contain `no-cache`.

The isCached(result) check is in addTokenToResponse() as suggested by
@jroper, this should catch all code paths that might unwisely attempt
to add a token to cached response.

https://github.com/playframework/playframework/pull/3321#discussion_r16579382
Body parser max length fix up

Fixes #2219 and #1666

Made many changes, including:

* Java body parsers let the Scala body parser enforce the max length.
* A new configuration item, parsers.disk.maxLength, created for
  specifying the default max length for parsers that buffer content to
  disk (documented in body parser docs and migration guide)
* Max length changed to Long for disk types, so that bodies greater than
  2GB can be parsed.
* Max data length for `multipart/form-data` bodies is now enforced
  across the aggregate of all data parts.
* Deprecated the RequestBody.isMaxBodySizeExceeded flag, since 413 is
  now returned directly from all body parsers if the max length is
  exceeded.
Stop doing transaction asynchronously

* Deprecated JPA `withTransactionAsync`
* Use synchronous `withTransaction` from `@Transactional` action
Rollback transactions on fatal errors

Fixes #1854

Ensured that when errors not caught by NonFatal are thrown, the
transaction is still rolled back.
Anorm result cursor
Merge pull request #2042 from jroper/2042-remove-async-transaction

[2.2.1-java] impossible to use promise with withTransaction into @Transactional controllers
Merge pull request #1854 from jroper/1854-reset-connection

play.api.db.DB.withTransaction doesn't restore autocommit or reset connection
Merge pull request #2219 from jroper/2219-maxlength

RequestBody.isMaxSizeExceeded returns incorrect result for request body encoded in multipart/form-data
Merge pull request #3333 from cchantep/anorm-cursor

Anorm result cursor
Merge pull request #3321 from rtyley/do-not-add-csrf-token-to-cached-responses

CSRFFilter: Don't add CSRF tokens to responses that set cache headers