changing protect_from_forgery settings, adding requires constraint to email