Default protect from forgery
#29742

lugray wants to merge lugray:default_protect_from_forgery into rails:master

We do not currently have an analysis of these two commits