CheckForgerySetting Skips Controllers

[jsyeo]

Currently brakeman only performs protect_from_forgery checks in the ApplicationController. While this is sufficient for most cases, it fails to catch controllers that also inherit from ActionController::Base but use a different name. Like for example BaseController or AdminController. See https://github.com/typus/typus/blob/master/app/controllers/admin/base_controller.rb#L1 and https://github.com/spree/spree/blob/148bcaf1e44081f940248d94d3aa6c5e95bb4fe2/api/app/controllers/spree/api/base_controller.rb#L5.

This commit was recently added to typus to turn on CSRF protection. This shows that brakeman shouldn't just simply restrict itself to ApplicationControllers.

[presidentbeef]

Agree, related to #664.