1.3.0

• Preserve CSRF errors when using headers and cookies together
• Allow only specified request types to need CSRF protection, when using cookies with CSRF protection enabled. Defaults to ['PUT', 'PATCH', 'POST, 'DELETE'], and can be change with the app.config['JWT_CSRF_METHODS'] option