standard Rails4 ApplicationController best practice for protect_from_forgery