Devise session immediately expiring on .js call [AJAX]

Through much trial and error, I have narrowed the problem down to line 5 below. For some reason, the .js response is ending the user session. Using 3.0.4 and devise 1.1.7 (and jQuery 1.5).

Additionally, @organization is being updated and Completed 200 OK shows in the log, so the user does no know he开发者_开发百科/she is logged out until the next action is attempted.

Any help and guidance is greatly appreciated.

*Controller*
1   def make_featured
2     @organization = Organization.find(params[:id])
3     @organization.is_featured ? @organization.update_attribute(:is_featured,"false") :   @organization.update_attribute(:is_featured,"true")
4       respond_to do |format|
5         format.js {render :action => "update", :layout => false}
6       end
7   end

and

*update.js.haml*
$("#organization_" + "#{@organization.id}" ).replaceWith("#{ escape_javascript(render :partial => 'users/supplier_view', :locals => {:organization => @organization}) }");

---

Many thanks to Brandon Martin from the Devise Google Group for pointing me int he right direction...

This is a result of a Rails 3.0.4 security fix.

http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails

After an hour or so of working forward from this blog post, here are some tips for others...

• This has been fixed in rails.js - so you don't have to hack, patch, or reinvent the wheel.
• If you are using rails.js out of the box, update it - rake rails:update (I think, but I use a customized rails.js file)
• If you are using a custom rails.js file, go get the source code to the newest version here: https://github.com/fermion/jquery-ujs/blob/master/src/rails.js
• place your csrf_meta_tag helper above your javascript_include_tags

Hope that helps!