I blogged about it at http://blog.bigbinary.com/2012/05/10/csrf-and-rails.html .