Prepend the CSRF filter to make it much more difficult to execute application code before it fires.

actionpack/lib/action_controller/metal/request_forgery_protection.rb

@@ -66,7 +66,7 @@ module ClassMethods
       # * <tt>:only/:except</tt> - Passed to the <tt>before_filter</tt> call.  Set which actions are verified.
       def protect_from_forgery(options = {})
         self.request_forgery_protection_token ||= :authenticity_token
-        before_filter :verify_authenticity_token, options
+        prepend_before_filter :verify_authenticity_token, options
       end
     end