Revert protect_from_forgery remove (my bad)

I'm sorry, I break out the popup rendering, this fix it :)