xsrf token middleware moved to a gem