title: Why does the CSRF token in Rails not prevent multiple tabs from working properly?
body: <p>After reading about how the CSRF protection works in Rails, I tried to trigger CSRF protection by doing this:</p>
  
  <p>Note: We are using cookie based sessions.</p>
  
  <ol>
  <li>Visit login page. Check CSRF token in meta => abc123</li>
  <li>Open a 2nd browser tab, and visit the same login page. CSRF token in meta is different => def456</li>
  <li>Go back to 1st tab.</li>
  <li>Submit login credentials.</li>
  </ol>
  
  <p>I expected this to fail, because the 2nd tab generated a new, different CSRF token. When the login form submits, shouldn't the token that gets submitted to the server be an old, stale one? </p>
  
  <p>However, this <em>does</em> work:</p>
  
  <ol>
  <li>Visit login page. Check CSRF token in meta => abc123</li>
  <li>Open a 2nd browser tab, and visit the same login page. CSRF token in meta is different => def456</li>
  <li>Go back to 1st tab. </li>
  <li>Submit login credentials.</li>
  <li>Logout (clearing session)</li>
  <li>Go to 2nd tab, and submit login.</li>
  </ol>
  
  <p>In this case, I get an InvalidAuthenticityToken exception as expected. Why?</p>