fix csrf by adding skip_before_action :verify_authenticity_token