Merge updated csrf options.
Comment out method that Rails 4.1.4 doesn’t like. Surely breaks some stuff.
Fix dependency for the engine at 4.0.x. 

This is important because otherwise bundle on the main app will install 4.1,
causing all kinds of deprecated features not to work.