Added protect_from_forgery back in application_controller

This was accidentally removed at some point. It's required for security purposes.