Cover one more case in auth_token and remote forms

If embedding auth_token in remote forms is off and we
pass a value for auth_token it should respect it.

actionpack/lib/action_view/helpers/form_tag_helper.rb

@@ -629,7 +629,7 @@ def html_options_for_form(url_for_options, options)
 
             if html_options["data-remote"] &&
                !embed_authenticity_token_in_remote_forms &&
-               html_options["authenticity_token"] != true
+               html_options["authenticity_token"].blank?
               # The authenticity token is taken from the meta tag in this case
               html_options["authenticity_token"] = false
             elsif html_options["authenticity_token"] == true

actionpack/test/controller/request_forgery_protection_test.rb

@@ -149,6 +149,13 @@ def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_t
     end
   end
 
+  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested
+    assert_not_blocked do
+      get :form_for_remote_with_external_token
+    end
+    assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
+  end
+
   def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
     assert_not_blocked do
       get :form_for_remote_with_token