add counter to User; checkpoint 06
write our own custom protection against CSRF attack

checkpoint 07
user Rails csrf methods

auth-08