css animations, devise, csrf needs to be verified