Moved 'params[request_forgery_protection_token]' into its own method and improved tests.