BTW, `protect_from_forgery with: :exception` was generated by `rails new` (so that's default behaviour)