rails/rails — pull request #13345 by jeremy (2013-12-17 04:59:23+00:00)
Title: CSRF protection from cross-origin <script> tags

Extend `protect_from_forgery` to cover GET requests with JavaScript responses, protecting apps from cross-origin