remove :get from routes, modify csrf handling in application_controller, remove csrf handling in webhook_controller