Fix #3358 CSRF meta tags specification

[klimov-paul]

Fix #3358 unnesessary meta tags in email html

CSRF meta tags specification reworked to be triggered by Request instead of View

[qiangxue]

Well, this fix has several drawbacks:

• Every request will run this piece of code, no matter view is used or not. This is especially bad for RESTful APIs.
• Sometimes you may use a different view component than the view application component.
• There is still coupling between Request and View.

[klimov-paul]

What about #3358 (comment) ?

[qiangxue]

Yes, that's similar to what I proposed. It is also the way used in other frameworks.
We can create a method Html::csrfMetaTags() to encapsulate the needed code and call the method in the head section of the main layout file.

Yes, this will break BC, which is expected.

[cebe]

@qiangxue That sounds like the best solution to me as there is less coupling between the compoents.

[klimov-paul]

Closed in favor of #3724