CVE-2016-3098: administrate vulnerable to Cross-Site Request Forgery

The vulnerability stems from the absence of CSRF protection in Administrate's base ApplicationController. The advisory explicitly states that Administrate::ApplicationController lacked the protect_from_forgery method, which is Rails' standard CSRF protection mechanism. The provided workaround involves adding protect_from_forgery to this controller, confirming that its absence was the root cause. Since all controller actions inherit from this vulnerable base class, the entire controller's lack of protection is the key issue.