demonstration of csrf protection in rails