Backport authenticity_token parameter for form_for

Allow authenticity token to be omitted for external requests