document protect_against_forgery? method