More tweaking
have to turn on the exception for protect_from_forgery
Got null_session working with protect_from_forgery