move protect_from_forgery to the beginning of the before_filter chain as per the recommended rails practices

Merged from master d7a9adf8

Conflicts:

	app/controllers/application_controller.rb