post request example, changed application_controller to not check forgery