Use reset_session for protect_from_forgery