original settings with protect_from_forgery in items controller