Merge pull request rmosolgo#2557 from daemonsy/protect_from_forgery

Comment out protect from forgery code, let the consumer opt in

Author: Robert Mosolgo

lib/generators/graphql/templates/graphql_controller.erb

@@ -2,7 +2,7 @@ class GraphqlController < ApplicationController
   # If accessing from outside this domain, nullify the session
   # This allows for outside API access while preventing CSRF attacks,
   # but you'll have to authenticate your user separately
-  protect_from_forgery with: :null_session
+  # protect_from_forgery with: :null_session
 
   def execute
     variables = ensure_hash(params[:variables])

spec/integration/rails/generators/graphql/install_generator_spec.rb

@@ -179,7 +179,7 @@ class GraphqlController < ApplicationController
   # If accessing from outside this domain, nullify the session
   # This allows for outside API access while preventing CSRF attacks,
   # but you'll have to authenticate your user separately
-  protect_from_forgery with: :null_session
+  # protect_from_forgery with: :null_session
 
   def execute
     variables = ensure_hash(params[:variables])