removed argument from protect_from_forgery