Brakeman update

Making this a PR so that the tests can run against it.

Really want to find out why protect_from_forgery was commented out.