@kmerz Since rails 4, the csrf token handling needs to be done by yourself.
If you call an action without csrf token, it will display the error in the production log, but wont
prevent you from calling it, because you need to handle it explicitly