commented out protect_from_forgery in application controller