not check authenticity when allow_forgery_protection set to false