Skip csrf plug when plug_skip_csrf_protection private is true
For Javascript GET requests, allow only XHR reqs