Only authenticate for create and delete requests
Always respond to `#create` with the JSON

Requiring the .json on the URL was causing issues in IE.
Use the version of simplemodal that is pulled from github

There is an IE fix in 1.4.5-SNAPSHOT that isn't in 1.4.4. Using 1.4.4
was causing JS failues in IE.
Send authenticity_token with attachment uploads
Fixes a bug in IE 11

`visibility: hidden` was being treated too much like `display: none`