Backport f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3 to 1.3

Use the form action URL in generated form hashes.

By including the URL in generated hash for secured forms we prevent
a class of abuse where a user uses one secured form to post into
a controller action the form was not originally intended for. These
cross action requests could potentially violate developer's mental model
of how SecurityComponent works and produce unexpected/undesirable
outcomes.

Due to the limitations of 1.3, only the *path* is used as a hash input.
This is slightly less hard than the 2.x implementation but should be
enough to prevent most forms of misuse.

Thanks to Kurita Takashi for pointing this issue out, and suggesting
a fix.