Disable the request token check for idempotent actions

[aschempp]

FINALLY removes the request token check for idempotent actions in the back end.

[Toflar]

❤️

[leofeyer]

This reenables the CSRF vulnerability that we had closed in contao/core#4007, doesn‘t it? @ausi /cc

[fritzmg]

The original issue was about editing and deleting. The request token check is still in place for delete and toggle actions and for POST requests.

[Toflar]

Anything we know is idempotent, does not need a token.

[ausi]

Are we sure, that act=edit, act=show and act=select are always idempotent?

[Toflar]

Yes, that's the whole purpose of this PR :D

[aschempp]

Are we sure, that act=edit, act=show and act=select are always idempotent?

Technically, someone could manipulate data in the onload callbacks. But then again you could also manipulate data in the list/parent/tree view where there is no request token check.