CSRF protection should rescue exception not extend

I think the changes to the default behaviour mean that rails will throw an exception when an invalid authenticity token is found.  The previous proposed code of calling super then sign_out meant that sign_out was never reached - the exception handler never returned.

I think the best approach now is to catch the exception, although I'm not 100% certain on that.
Include default rails protect_from_forgery with: :exception

Extend previous changes, include the default line from the application controller that new rails applications are created with:
  protect_from_forgery with: :exception

Minor wording changes to align.
Refactored code to depend on connection handler's #with_connection instead of #connection.

Any place that called #connection that did not store it in some field was changed to use #with_connection because #with_connection will create a connection, run the block that needs that connection, and then let go of the connection so that connections are held onto.