def verify_authenticity_token # :doc:
        mark_for_same_origin_verification!

        if !verified_request?
          if logger && log_warning_on_csrf_failure
            if valid_request_origin?
              logger.warn "Can't verify CSRF token authenticity."
            else
              logger.warn "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})"
            end
          end
          handle_unverified_request
        end
      end
def verify_authenticity_token # :doc:
        mark_for_same_origin_verification!

        if !verified_request?
          if logger && log_warning_on_csrf_failure
            if valid_request_origin?
              logger.warn "Can't verify CSRF token authenticity."
            else
              logger.warn "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})"
            end
          end
          handle_unverified_request
        end
      end
The actual before_action that is used to verify the CSRF token.
 Don't override this directly. Provide your own forgery protection
 strategy instead. If you override, you'll disable same-origin
 <tt><script></tt> verification.

 Lean on the protect_from_forgery declaration to mark which actions are
 due for same-origin request verification. If protect_from_forgery is
 enabled on an action, this before_action flags its after_action to
 verify that JavaScript responses are for XHR requests, ensuring they
 follow the browser's same-origin policy.