More rails n00bness, remove CSRF authentication and don't render a template on create