fix ActionController::InvalidAuthenticityToken bug