add thin gem, and set rails authenticity token for one-off forms