add set_csrf_cookie_for_ng to application_controller to combat cross-site scripting attacks in Angular