Added request.head? to forgery protection code