Just curious, why is this commented out? It protects your site from certain attacks, and there should be no reason to disable it in a vanilla Rails app.