Allow CsrfProtected on classes

Author: chkal

core/src/main/java/org/mvcspec/ozark/security/CsrfValidateInterceptor.java

@@ -179,7 +179,8 @@ private boolean needsValidation(Method controller) {
             case IMPLICIT:
                 return true;
             case EXPLICIT:
-                return hasAnnotation(controller, CsrfProtected.class);
+                return hasAnnotation(controller, CsrfProtected.class)
+                        || hasAnnotation(controller.getDeclaringClass(), CsrfProtected.class);
         }
         return false;
     }