Allow forgery protection to be enabled/disabled app-wide

[matthewmcgarvey]

Purpose

Resolves #1656

A follow-up pr will need to be made to lucky_cli that adds configuration disabling it in the test environment.

Description

Needed by luckyframework/lucky_flow#137 to allow using things like links with different request methods that would normally use javascript to set the CSRF token on the request.

Checklist

• - An issue already exists detailing the issue/or feature request that this PR fixes
• - All specs are formatted with crystal tool format spec src
• - Inline documentation has been added and/or updated
• - Lucky builds on docker with ./script/setup
• - All builds and specs pass on docker with ./script/test