Plug protect_from_forgery in browser pipeline by default
Merge pull request #523 from gjaldon/csrf-protection

Plug CSRFProtection by default to browser pipeline