added show_by_fb_id to users
added exeption to protect_from_forgery to plans