Undo skipping authenticity_token for session controller