I only ask because cross-site request forgery protection is enabled by default in Rails 3 and require some extra coaxing with its authenticity token. Since this is in Rails 2.3.8 as you've highlighted, it's a moot point.