use gem to fix CSRF token error instead