title: CSRF not working in Rails?
body: <p>If I create a brand new Rails application (using Rails 3.0.9) and knock up a quick bit of scaffolding as follows:</p>
  
  <pre><code>$ rails new testing
  $ rails g scaffold thing name:string
  </code></pre>
  
  <p>Then app/controllers/application_controller.rb contains a "protect_from_forgery" by default, so it should check the authenticity_token during a POST create.  At least, that's my understanding.</p>
  
  <p>Why then, does this line successfully create a new Thing, without supplying the token.</p>
  
  <pre><code>$ curl -F "thing[name]=abc123" http://localhost:3000/things
  </code></pre>
  
  <p>The log entry says:</p>
  
  <pre><code>Started POST "/things" for 127.0.0.1 at 2011-07-05 08:29:18 +0100
    Processing by ThingsController#create as 
    Parameters: {"thing"=&gt;{"name"=&gt;"abc123"}}
    AREL (0.3ms)  INSERT INTO "things" ("name", "created_at", "updated_at") VALUES  ('abc123', '2011-07-05 07:29:18.484457', '2011-07-05 07:29:18.484457')
  Redirected to http://localhost:3000/things/18
  Completed 302 Found in 89ms
  </code></pre>
  
  <p>I can also do this to delete records:</p>
  
  <pre><code>$ curl -X DELETE http://localhost:3000/things/18
  </code></pre>
  
  <p>The same thing happens in production mode.  Doesn't this leave my application open to CSRF?  </p>