comment out skip authenticity token in session controller