skip authenticity token checking
add thin for development support