Merge pull request #1378 from fabik/patch-17

Forms: the CSRF token is protected against BREACH attack
Http: added HTTP header with random length to complicate BREACH attack