Rails 3.0.7 Restful_Authentication, Why does destroy try to log in from cookie while others do not?

I have an app that I am upgrading to Rails 3 which uses the restful_authentication plugin. I have the authenticated_system.rb in the lib directory where it seems to be able to find it. I have put puts in the library to figure out what it does on each call. When I call any method besides destroy the puts statement tells me it has logged in from session. When I try to use the destroy method in a controller (does not matter which) it tells me that it is trying to login from cookie, which fails because the system is set up not to use cookies. Why would it be doing this? The code is exactly the same for all of them and the before filter is simply:

def validate_user_type
if ( current_user.user_type == User::UserType::VIEWER )
redirect_to :controller => 'assets', :action => 'myassets'
end

This fil开发者_开发技巧ter is applied to everything Any ideas?

---

Try button_to instead of link_to for you delete actions.

I had the same problem, it was because I was using link_to with the :remote option.
This was not passing the authenticity_token in the post parameters, and therefore restful_authentication was failing.

I switched to using button_to, the authenticity_token was included and my deletes started working.

---

I found this, never posted though, check the application layout for csrf tags, if these are not there it will do some funky things. This was the problem.