change: application_controller protect_from_forgery to :null_session