commented out protect_from_forgery in application_controller