title: Risks with protect_from_forgery :except => [:new] in Rails 4.2.0 app
body: <p>After upgrading from 3.2 to rails 4.2.0, the ajax call to create a new log caused exception in integration spec:</p>
  
  <pre><code>Failure/Error: click_link 'New Log'
       ActionController::InvalidCrossOriginRequest:
         Security warning: an embedded &lt;script&gt; tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.
  </code></pre>
  
  <p>Here is a <code>New Log</code> button:</p>
  
  <pre><code>link_to t('New Log'), commonx.new_log_path(:resource_id =&gt; @part.id,  :format =&gt; :js), :remote =&gt; true
  </code></pre>
  
  <p>After adding :except => :new to <code>application controller</code>, the exception disappeared. Now it looks like this in app's <code>application controller</code>:</p>
  
  <pre><code>protect_from_forgery :except =&gt; [:new]
  </code></pre>
  
  <p>I look around online and still not have a clear understanding of the potential risks associated with this <code>except</code>. Would someone shed a light on this?</p>