I think I'd also move `protect_from_forgery` to the feedback controller from application controller.