Only skip CSRF protection in voice feedbacks controller

Upcoming features will need `authenticity_token` verified according to discussions with @daguar and @rduecyg.