added form, app kicked out a SecurityToken error so changed protect_from_forgery to :null session