rails/rails — pull request #14786 by PaulL1 (2014-04-17 12:05:18+00:00)
Title: CSRF protection should rescue exception not extend

I think the changes to the default behaviour mean that rails will throw an exception when an invalid authenticity token is found. The previous proposed code of calling super then sign_out meant that sign_out was never reached - the exception handler never returned.

I think the best approach now is to catch the exception, although I'm not 100% certain on that. I've handled this by proposing the documentation change, rather than just asking the question - feel free to reject if this isn't the right solution.