The solution: In application.rb, uncomment the :secret.

No :secret given to the #protect_from_forgery call.  Set that or use a session store capable of generating its own keys (Cookie Session Store).

Korsord till tidningar och tidskrifter: Krysspiraten