Use Doorkeeper::ApplicationController.protect_from_forgery

Since the Doorkeeper controllers inherit from Doorkeeper::Application
(which inherits directly from ActionController::Base) and not
ApplicationController, they never call `protect_from_forgery`, which
means that non-GET methods don’t validate CSRF tokens. Thus, it’s
possible for an attacker to host a form on an arbitrary URL, and if a
users is logged into a site that uses Doorkeeper visits the URL, the
attacker can grant access to a application on that site.