Minor change in comment.
Import OPML form behaves better with fragment caching.

We're caching the whole form. The authentication_token hidden field must be present and have the right CSRF token, otherwise the POST won't work (this form is submitted normally, not via AJAX, because uploading files cannot be done with AJAX). It doesn't really matter which value authentication_token has in the cached fragment, because Rails' unobtrusive JS will set the correct value when the page is loaded (this is not documented anywhere, but jquery_ujs gets the CSRF token from the meta tag in the head, and sets it in the authentication_token field of any forms in the page; this is to silently correct the common case in which a form fragment gets cached with a fixed authentication_token, which probably won't be valid for other sessions).

Despite the form actually working, users could still see the original authentication_token with an HTTP sniffer or blocking the javascript execution. There is a possibility that this token is still valid for the user that first cached the fragment, leading to a possible CSRF vulnerability.

It's better to give the authentication_token a fixed value (e.g. an empty string) which is not valid for any user, and let jquery_ujs do its magic and replace it with the correct CSRF.

Important: the form must actually have the authentication_token hidden field, even if the value is an empty string. Jquery_ujs sets the correct value, but it doesn't add the field if it's not present in the form (for Ajax forms, e.g.).
Added caching and removed authentication_token field from forms that are part of the read view.

Those forms are submitted via Ajax, so the token field is not necessary. The CSRF token will be sent in an HTTP header to make the forms work.
Added caching and refined authentication token in forms that are part of the edit registration view.

The invite friend form is an Ajax form, so no authentication_token field is inserted. The destroy profile form is a regular form, so the authentication token field is present with an empty string for value; the jquery_ujs library will update this field with the correct CSRF token extracted from the page header.