[Rails5] Force the `protect_from_forgery` callback run first Closes #48204 See merge request gitlab-org/gitlab-ce!20055