MB-10942: only allow non-GETs token auth for UI

Our UI always adds header to it's requests. Which CSRF is unable to
duplicate.

So we still do UI auth via cookie. Which is super-convenient
(particularly for /diag link in UI). And we cover our ass from CSRF by
requiring that all non-GET requests (only type of requests that are
vulnerable to CSRF) have ui header added.

Change-Id: I48098dab04855109f270e2a01809cd5f726ebe8b
Reviewed-on: http://review.couchbase.org/36814
Tested-by: Aliaksey Kandratsenka <alkondratenko@gmail.com>
Reviewed-by: Aliaksey Artamonau <aliaksiej.artamonau@gmail.com>