Make sure modified request isn't stopped by Rack::Protection::AuthenticityToken

If user doesn't have csrf set yet, then
Rack::Protection::AuthenticityToken will happily stop post request