title: Rails: Test against and handle ActionController::InvalidAuthenticityToken
body: <p>I have a Rails web app with some forms users can use to comment etc. They are frequently being used by spammers trying to create spam comments. Nothing new about that.</p>
  
  <p>Sometimes I get CSRF-hack attempts which causes an ActionController::InvalidAuthenticityToken exception. This happens quite a lot and I would like to rescue and send the user/bot to a "You failed to comment"-page.</p>
  
  <p>This has turned out to be a tricky exception to catch though since I can't recreate the error myself. I first put a rescue in the #create when the model (created by the form) was to be saved but it doesn't catch the exception. In order to do so I consider having it cover the entire controller section but that seems over the top.</p>
  
  <p>My two questions:</p>
  
  <ol>
  <li><p>Is there a way to re-create an ActionController::InvalidAuthenticityToken error by myself, so I can test it?</p></li>
  <li><p>When is the exception raised? During .save? On Comment.new? Basically, where should I put my begin/rescue?</p></li>
  </ol>
  
  <p>Thanks!</p>