disable rails4 'forgery' protection on actions we intentionally want to be callable by js on remote sites