Removed :without_protection for Rails 4.0 compatibility

Change applied to master - needs to be applied to stable 2-1 for  Rails 4 compatibility.