Change URL, protect from forgery all except #push_uri and #confirmation