Is the verify_authenticity_token filter part of iframe busting? Do we lose our CSRF protection by skipping this filter?