Played with application_controller protect_from_forgery settings - left as :exception strategy