You're correct. Thankfully Rails4 provides the option of doing this by default, but in my opinion, it should still be default behavior, and should not require an option to the protect_from_forgery method.

Unfortunately, the Rails team have stated that it was introduced as an option, rather than default behavior for backwards compatibility reasons. It leaves me to wonder how many applications would actually have an issue if the default behavior was to generate an exception.