See

http://travis-ci.org/#!/rails/rails/jobs/2444632

It's further work on CSRF after 24594110.

The :null_session CSRF protection method provide an empty session during
request processing but doesn't reset it completely (as :reset_session
does).

can be configured using `:with` option in `protect_from_forgery` method
or `request_forgery_protection_method` config option

possible values:
- :reset_session (default)
- :exception

new applications are generated with:

    protect_from_forgery :with => :exception

American English(according to Weber)

Replace references to ActiveSupport::SecureRandom with just SecureRandom, and require 'securerandom' from the stdlib when active support is required.

Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets.  To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header:

 X-CSRF-Token: ...

This fixes CVE-2011-0447

revises implementation and documentation of csrf_meta_tags, and aliases csrf_meta_tag to it for backwards compatibilty

Booting a new Rails application does not work after this commit [#5359 state:open]

This reverts commit 38a421b3.

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Clean up the config object in ActionPack. Create config_accessor which just delegates to the config object, reducing the number of deprecations and add specific tests.

ActionController::Base.request_forgery_protection_token should actually be the name of the token and not true.

	This is an interim solution pending revisiting the rails
	framework configuration situation. 

For some reason the current class_inheritable_accessor does not play nice with included hooks. class_inheritable_accessor will be revised shortly.