This is essentially undoing trying to undo the line just before it.  You can simply remove protect_from_forgery with :null_session.  We can talk more about how the attack works and when you'd want it versus when you would not.