We were manually adding forgery protection to all our controllers, but in Rails 5.2 there's an option (enabled by default for new applications) which adds this protection to all controllers.
Tag
ActsAsTaggableOn::Tag
PercentLiteralDelimiters