Would it make sense to use `$('meta[name="csrf-token"]').attr('content')` instead of `'abc123'` here? There's probably some security risks in sharing the user's csrf-token with a third party.

In any case, since people may use OmniAuth without Rails, can't we include some kind of crypto function like [this](http://stackoverflow.com/questions/5933282/securerandom-in-javascript) and use it instead of `'abc123'`? Even though these javascript functions aren't truly random, it would be better than a static string.