Move remote_forgery_protection to /lib