CSRF supports HEAD method