setup db, jquery.turbolinks, api controller ignore CSRF