Added Controller::enableCsrfValidation to support turning on/off CSRF validation for particular actions.

session autostart would fail otherwise.
fixes #887

added version, csrfVar and csrfToken to yii js module.

- rename FileHelper::mkdir for API consistency
- changed default permission for directories to 775 instead of 777
- added some properties to classes that deal with files to allow control
  over directory permissions.

Fixes #829: loginRequired now responds with HTTP 403 in case of AJAX or loginUrl is not set (reverted from commit c2c12a90)