rails/rails — pull request #10006 by homakov (2013-03-30 14:10:59+00:00)
Title: Update csrf_helper.rb (KISS)

i want to propose a breaking change to make naming convention simpler.
I never saw people to modify `request_forgery_protection_token`. Look at this code:
```
form_authenticity_token == params[request_forgery_protection_token] ||
form_authenticity_token == request.headers['X-CSRF-Token']
```
Why param's name is variable but header name is constant? And, why default name is 'authenticity_token'? (In fact CSRF is about authorization, not authentication. So, this naming sucks).

I propose to have X-CSRF-Token and csrf_token as constant names for CSRF token. Yes, completely constant in code. Such things are never modified.

It is a speaking name and developers will understand what does it exactly do. I never understood where is "authenticity" part in authenticity_token.

p.s. PR is not done, what do you think?