lest/rails — comment on commit 81c380ac193dcdd9a1af7e766c5967b72cff55cf
File: actionpack/lib/action_controller/metal/request_forgery_protection.rb line 95
By NZKoz:

Should raise an exception of some sort in an else here, otherwise accidentally setting it to `:rset_session` leaves your app completely unprotected. Could probably just raise `ArgumentErrors`