title: InvalidCrossOriginRequest when trying to send a Javascript Asset
body: <p>I'm trying to create an "asset controller" shim which will filter static asset requests so only authorized users can get retrieve certain assets.  I wanted to continue to use the asset pipeline so I setup a route like this</p>
  
  <pre><code>get 'assets/*assetfile' =&gt; 'assets#sendfile'
  </code></pre>
  
  <p>Then I created an AssetsController with one method "sendfile".  Stripping it down to only the stuff that matters, it looks like this:</p>
  
  <pre><code>class AssetsController &lt; ApplicationController
    def sendfile
      # Basically the following function forces the file
      # path to be Rails.root/public/assets/basename
      assetfilename=sanitize_filename(params[:assetfile] + '.' + params[:format])
  
      send_file(assetfilename)
    end
  end
  </code></pre>
  
  <p>It looks like I have to run this in production mode as rails by-passes my route for assets in development.  So I precompile my assets and I can verify in the controller that the files exist where they are expected to be.</p>
  
  <p>However, now the problem is that I'm getting a "ActionController::InvalidCrossOriginRequest" when the Javascript asset is requested (just using the default application.* assets for now).  I've read about this error and I understand that as of Rails 4.1 there are special cross-origin protections for Javascript assets.  Sounds good to me, but I don't understand where the "cross-origin" part is coming from.  Using firebug, I can see that the asset requests are being requested from the same domain as the original page.</p>
  
  <p>I am certain that this is the problem because I can solve it by putting "skip_before_action :verify_authenticity_token" in the beginning of my controller.  However, I really don't want to do this (I don't fully understand why this check is necessary, but I'm sure there are very good reasons).</p>
  
  <p>The application.html.erb file is unchanged from the default generated file so I assume it's sending the CSRF token when the request is made, just as it would if I didn't have my own controller for assets.</p>
  
  <p>So what am I missing?</p>