[rails 4.1] apotomo render event response will cause ActionController::InvalidCrossOriginRequest

[Qinghua Chen]

Here is some info from rails4.1 release notes:

• 2.8 CSRF protection from remote tags Cross-site request forgery (CSRF) protection now covers GET requests with JavaScript responses, too. That prevents a third-party site from referencing your JavaScript URL and attempting to run it to extract sensitive data.

  This means any of your tests that hit .js URLs will now fail CSRF protection unless they use xhr. Upgrade your tests to be explicit about expecting XmlHttpRequests. Instead of post :create, format: :js, switch to the explicit xhr :post, :create, format: :js.

•