why skip this instead of including the authenticity token?