If people can skip `verify_authenticity_token` in a controller that inherits `protect_from_forgery`, then `mark_for_same_origin_verification` would still be triggered and thus `verify_same_origin_request` too, not? Would they need to skip that too, independently?