title: skip verify authenticity token vs protect from forgery with null session?
body: <p>I'm building a Rails app that needs to receive POST'd emails from Mailgun. All OK, I have a controller and routes for that.</p>
  
  <p>All requests receives <code>HTTP 422</code> because Rails says <code>Invalid Authenticity Token</code>, which is really expected in this case.</p>
  
  <p>I won't use <code>rack-cors</code> because I only allow Mailgun proceeding requests authenticating with its own signature mechanism.</p>
  
  <p>Here my question: Should I use <code>skip_before_action :verify_authenticity_token</code> or should I use <code>protect_from_forgery with: :null_session</code>?</p>