No :secret given to the #protect_from_forgery call. Set that or use a session store capable of generating its own keys (Cookie Session Store).
解决办法:将/controllers/application.rb中的protect_from_forgery后面的注释取消.
I hope the blog could remember my trace everyday...