disabled rack-protection: http_origin, remote_token, interferred with friends-adding