ExportController security issue (minor)

[SamMousa]

Steps to reproduce the issue

1. Read https://github.com/kartik-v/yii2-grid/blob/master/controllers/ExportController.php#L33
2. Note that export configuration is taken from the post data instead of the application setting.

Issue

When I configure the griddview not to use pdf export (for example) the user should not be able to ignore that and just send his own POST request demanding a PDF export.
If you want to be stateless in the export, the original configuration should at least be signed so that it can be verified in the control.

Consider a scenario where you disable PDF exporting (maybe it's too heavy on your server). Any user can than still force PDF export by simplying forging a POST request manually.

Isolating the problem

• This bug happens on the demos page
• The bug happens consistently across all tested browsers
• This bug happens when using yii2-grid without other plugins.