Ajax calls via the rails helpers get the authenticity token, so it is somewhere that js can get to in theory. I don't remember where off the top of my head, they keep changing this across rails versions.

> On Mar 25, 2014, at 23:19, tobyk100 <notifications@github.com> wrote:
> 
> In app/controllers/levels_controller.rb:
> 
> >    before_filter :authenticate_user!
> > -  skip_before_filter :verify_authenticity_token, :only => [:builder, :create_custom]
> > -  load_and_authorize_resource
> > +  skip_before_filter :verify_authenticity_token, :only => [:create]
> mmm, I want to do it. I'll keep looking into it. There's two ways that create gets called, maze builder and artist builder. Maze builder was easy because it's a form and I could just add the hidden field with the auth token. But artist builder is an ajax post. It seems I can't get to the current auth token. I'll keep investigating. ty
> 
> —
> Reply to this email directly or view it on GitHub.