Remove form_authenticity_token method

[willnet]

Fix #330

As detailed in the URL below, the call to form_authenticity_token wasn't useful and was causing issues like #330, so remove it.

ref:

• Change CI settings for support Ruby3.0+ Rails6.1+  #357 (comment)
• Change CI settings for support Ruby3.0+ Rails6.1+  #357 (comment)

[Spone]

Why wasn't is useful? Can you elaborate?

What about including the module as described in #330 (comment)?

[joshbuker]

@Spone to invert the question, what is the purpose of calling form_authenticity_token? That's something I don't fully understand yet personally, and from what @willnet is suggesting, it's actually not doing anything useful.

My assumption would be that it's to generate the csrf token in a scenario where rails wouldn't already do so, but that seems like it might be a legacy issue that is no longer relevant.

[Spone]

Apparently it was added in 8a7490c in order to add _csrf_token to the session.

I agree that if the behavior is not fully understood, and that removing the line does not break any test, and furthermore helps solve a current issue, we should do it.

[willnet]

As I mentioned here, I don't have enough information from this PR to be certain, but I believe form_authenticity_token was added in an attempt to solve this issue. My guess is that it was meant to maintain session[:_csrf_token] even after reset_session is executed. However, in reality, session[:_csrf_token] does not remain but is updated, so if my guess is correct, this method call becomes particularly meaningless.

[willnet]

I have resolved the conflict in CHANGELOG.md