title: Rails 5.0.0beta3: ActionController::InvalidAuthenticityToken in development
body: <p>I have just started a simple app with a couple of forms on Rails 5.0.0beta3.</p>
  
  <p>In development, using <a href="http://localhost:3000" rel="nofollow">http://localhost:3000</a> on Safari or Chrome to access the app, if I fill a form and submit it I always get an <code>ActionController::InvalidAuthenticityToken</code> error.
  However, if I reload the page before filling and submitting it then it works fine.</p>
  
  <p>The app uses the defaults:</p>
  
  <ul>
  <li><code>protect_from_forgery with: :exception</code> in ApplicationController,</li>
  <li><code>&lt;%= csrf_meta_tags %&gt;</code> in html header through application layout,</li>
  <li>development environment as created by rails.</li>
  </ul>
  
  <p>Example:</p>
  
  <pre><code>&lt;%= form_for @node, url: admin_book_nodes_url, as: :node do |form| %&gt;
    &lt;%= render "form", f: form %&gt;
    &lt;p&gt;&lt;%= form.submit %&gt; or &lt;%= link_to "Cancel", admin_book_nodes_path %&gt;&lt;/p&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>Log:</p>
  
  <pre><code>Started POST "/admin/book/nodes" for ::1 at 2016-03-20 11:54:31 +0000
  Processing by Admin::Book::NodesController#create as HTML
    Parameters: {"utf8"=&gt;"✓", "authenticity_token"=&gt;"/G5pF6hSPx0Vf21Fi0FCh+VlOcHY4w8C5lmHmwr3NQRjfXUP9/xboybeV3tevmyTyHcwSX8LplU/HgZVGDbGlw==", "node"=&gt;{"parent_id"=&gt;"1", "position"=&gt;"1", "title"=&gt;"lkjlkj", "description"=&gt;"lkjlj", "published"=&gt;"0", "content"=&gt;"lkjlkj"}, "commit"=&gt;"Create node"}
  Can't verify CSRF token authenticity
  Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)
  </code></pre>
  
  <p>It works fine if I disable per form CSRF tokens in the controller (<code>self.per_form_csrf_tokens = false</code>) so my issue is really at that level.</p>
  
  <p>The session does not seem to be reset at any point.</p>
  
  <p>Interestingly, when the form is first loaded, the authenticity token in the header's menage tag is different from the token in the form. The meta tag is also at the bottom of the header's tags.
  When I then reload the tokens are the same in both the meta tag and the form, and the meta tag is at the top of the header's tags.</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I think that the issue is down to Turbolinks.</p>
  
  <p>When the form page is accessed from another page in the app, an XHR request is fired by Turbolinks, and I encounter the issue.</p>
  
  <p>However, when I reload the page the browser reloads it and I don't see the issue.</p>