Added brakeman
Removed the secret key from repo
Re-enable CSRF by default but override inside the API controllers