Protect from forgery with :null_session instead