addded protect from forgery to portfolios api controller