protect_from_forgery removed from because it's now on by default. ref: https://edgeguides.rubyonrails.org/configuring.html