<% cache 'header' do %>
  <head>
    <title>Feedbunch</title>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <%= favicon_link_tag '/favicon.ico' %>

    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css', media: 'all' %>
    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css', media: 'all' %>
    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css', media: 'all' %>
    <%= stylesheet_link_tag    'application', :media => 'all' %>

    <%= csrf_meta_tags %>
  </head>
<% end %>
<% cache 'header' do %>
  <head>
    <title>Feedbunch</title>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <%= favicon_link_tag '/favicon.ico' %>

    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css', media: 'all' %>
    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css', media: 'all' %>
    <%= stylesheet_link_tag    '//maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css', media: 'all' %>
    <%= stylesheet_link_tag    'application', :media => 'all' %>

<% end %>

    <%= csrf_meta_tags %>
  </head>

Fix huge bug: do not cache the part of the page header where the CSRF token is generated.
Fix huge bug: do not cache the part of the page header where the CSRF token is generated.

If that part of the page is cached, all users will be served the same CSRF token which obviously won't be valid for most of them. As a result, nobody can POST any form, in particular they are redirected to the login form even after a successful login.
