FIX: check for nil response on JsonCsrf protection

Some reaction do not return a response, think for example drop_session. In that case a nil response
would be returned, see issue #50.

rack-protection/lib/rack/protection/json_csrf.rb

@@ -19,7 +19,7 @@ module Rack
 
         if has_vector? request, headers
           warn env, "attack prevented by #{self.class}"
-          react(env)
+          react(env) or [status, headers, body]
         else
           [status, headers, body]
         end