Merge branch 'git-http-no-authenticity-token' into 'master'

Disable CSRF protection when serving Git HTTP clients

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/18331

See merge request !4538

app/controllers/projects/git_http_controller.rb

 class Projects::GitHttpController < Projects::ApplicationController
   attr_reader :user
 
+  # Git clients will not know what authenticity token to send along
+  skip_before_action :verify_authenticity_token
   skip_before_action :repository
   before_action :authenticate_user
   before_action :ensure_project_found!