Merge pull request #21634 from JuanitoFatas/feature/fewer-rack-env-direct-manipulate

Use rack.session_options instead of directly change env

actionpack/lib/action_controller/metal/request_forgery_protection.rb

@@ -138,7 +138,7 @@ def handle_unverified_request
           request = @controller.request
           request.session = NullSessionHash.new(request)
           request.flash = nil
-          request.env['rack.session.options'] = { skip: true }
+          request.session_options = { skip: true }
           request.cookie_jar = NullCookieJar.build(request, {})
         end