Yes. I'll move the marker to `verify_authenticity_token` to fix that.

I used a separate, private method because we encourage people to change the builtin method:
```ruby
      # The actual before_action that is used. Modify this to change how you handle unverified requests.
      def verify_authenticity_token
```
So an overriding method would miss the marking and skip same-origin verification.

I'm removing that comment. Shouldn't be overriding that method.