fix(CSRF) API calls from apps pages are not secured (#144)

- add new filter mappings for the token validator filter
- do not filter the requests of type HEAD and GET (was already the case
for GET)

Covers [BS-16004](https://bonitasoft.atlassian.net/browse/BS-16004)