add rack protection for form authenticity

- add middle for authenticity into config.ru
- remove old csrf checks that no longer are needed
- update form to use hidden value authenticity_token