Skip `anti_csrf_token` for `link_only` form