Exempt expire_session action from CSRF protection