allow options Hash in protect_from_csrf, closes #1422