ok, I'm more curious what's its avoiding. normally protect_from_forgery is needed without any options