Use CSRF protection, idiot. Also uses new before_action syntax for performing non-halting operations before actions