changed protect_from_forgery with to null_session