cookie images
Turn on request forgery protection, disable CSRF protection
Merge pull request #90 from fjfdepedro/master

cookie images and disable CSRF protection in create action (user and sessions)