do not verify_authenticity_token when status is called via post
also allow get status requests
no need for get requests
ignoring empty transactions status change requests