Fix the _token_check logic

[leofeyer]

This is how the RequestTokenListener currently works:

• Check the request token if it is a Contao request and the _token_check attribute is not false.
• Check the request token if it is not a Contao request but the _token_check attribute exists.

However, the latter case should be implemented as if the attribute is true, otherwise the request token would also be checked in the following case:

/**
 * @Route("/foo", defaults={"_token_check" = null})
 *
 * This is treated the same as "_token_check" = true, although null is falsey.
 */

---

The pull request also removes the redundant "_scope" = "backend", "_token_check" = true configuration, as "_token_check" = true is only required if the scope is not backend or frontend.

[aschempp]

The pull request also removes the redundant "_scope" = "backend", "_token_check" = true configuration, as "_token_check" = true is only required if the scope is not backend or frontend.

I don't think that is true? I explicitly need to disable the token check on frontend requests, e.g. on https://github.com/isotope/core/blob/2.8/system/modules/isotope/library/Isotope/Controller/PostsaleController.php#L16 !

Nevermind I misunderstood this 😆