Fixed a tricky bug associated with Rails's new CSRF protection.