We don't need this here IMO, the CSRF token gets included via the the `form_for` helper. Also, this makes all pages non-cacheable.