Fix update_access.
Update to rails 4.1.0.rc2 for real this time, and use cloud-crowd gem.
Disable CSRF for embeddable urls.