Restore forgery protection in app controller. It was probably removed accidentally.