reenabled protect_from_forgery