title: Form Authenticity Token getting changed
body: <p>I'm using Rails 4, I'm using the normal <code>form_for</code> helper which renders a hidden element which stores <code>form_authenticity_token</code> value. </p>
  
  <p>Now when I do the <code>POST</code> request I get the <code>ActionController::InvalidAuthenticityToken</code> error. These are my request parameters</p>
  
  <pre><code>{"utf8"=&gt;"✓", "authenticity_token"=&gt;"euVcp8lEVyg3JZVZeMGI0G2SV4y8Jukmz9GUv6ZO34I=",     "confirmation_token"=&gt;"jLdtGNf5fWnDiEjV5xDU", "user"=&gt;{"password"=&gt;"[FILTERED]", "password_confirmation"=&gt;"[FILTERED]"}, "commit"=&gt;"Activate"}
  </code></pre>
  
  <p>My <code>application.html.erb</code> also contains <code>&lt;%= csrf_meta_tags %&gt;</code></p>
  
  <p>So, I put the debugger inside source code and found out that, the value of <code>form_authenticity_token</code> is now changed to something else it's not same as the <code>authenticity_token</code>'s value in the request parameter &amp; hence the <code>verify_authenticity_token</code> raises an error.</p>
  
  <p>I don't know why this value is being changed. </p>
  
  <h2>Update</h2>
  
  <pre><code>def form_authenticity_token
    session[:_csrf_token] ||= SecureRandom.base64(32)
  end
  </code></pre>
  
  <p>First when I try to print <code>session</code> I get </p>
  
  <pre><code>#&lt;Rack::Session::Abstract::SessionHash:0x15cb970 not yet loaded&gt;
  </code></pre>
  
  <p>and then I force load by doing <code>session[:a] = :b</code></p>
  
  <p>and then I found out the value of <code>session[:_csrf_token]</code> is <code>nil</code> &amp; Hence the value is changed because a new random value is generated which doesn't match with my form value.</p>
  
  <p>Now I need to find out why it is <code>nil</code></p>