Avoid csrf token protection when esi / fragments are not available

[alexander-schranz]

Q	A
Bug?	no
New Feature?	no
Bundle Version	for 2.x
Sulu Version	for 2.x
Browser Version	-

Actual Behavior

Currently the SuluFormBundle needs that esi/fragments are enabled else on a cache side the csrf token will error on post request.

Expected Behavior

It should not be needed that esi/fragments need to be enabled, if they are not enabled csrf protection should be disabled.

Steps to Reproduce

Disable esi/fragments (symfony default) and try to submit on a cache side.

Possible Solutions

Detect if disabled and then disable the csrf protection. But it should be able to force csrf protection over:

sulu_form:
    csrf_protection: 'auto' // 'on', 'off'

TODO

• Make csrf protection based on esi available or not
• Update Symfony Flex Recipe