CSRF supports HEAD method

HTTP request always returns 500 error.
Report from user forum. https://groups.google.com/forum/#!topic/play-framework/k6b4X3iqtgg

backport to play 2.3.x.