Ruby on Rails Cross-Site Request Forgery
seclists.org