moved with_secure_token() calls to an around filter in ApplicationController