Add exhibitions to the seeds file.
Specify ruby version.
Don't protect_from_forgery.

It'll stop people posting to the API.