always use session[:csrf] for authenticity token
enable :sessions in order for csrf_protection to work properly