FIX: XSRF handling for esp-html-mvc

    Only generate security tokens in views.
    Check only if not a GET request.