title: Why does destroy action trigger HTTP authentication in Production in Rails 3?
body: <p>Screenshot of what happens when I press 'delete': <a href="http://twitpic.com/4mljuy" rel="nofollow">http://twitpic.com/4mljuy</a></p>
  
  <p>This is what I see in my production.log:</p>
  
  <pre><code>Started POST "/clients/1" for 127.0.0.1 at 2011-04-20 13:48:26 -0500
    Processing by ClientsController#destroy as JSON
    Parameters: {"id"=&gt;"1"}
  nil
  Completed   in 3ms
  </code></pre>
  
  <p>This is my destroy action in my controller:</p>
  
  <pre><code>def destroy
       client = Client.find(params[:id])
       client.destroy
       respond_to do |format|
          format.html { redirect_to("/") }
          format.js   { render :json =&gt; ['client',params[:id]].to_json, :layout =&gt; false }
      end
  end
  </code></pre>
  
  <p>This is the delete link in my view:</p>
  
  <pre><code>&lt;span class="icon destroy-icon" data-destroy-title="Delete &lt;%= client.email %&gt;?" data-destroy-url="&lt;%= client_path(client) %&gt;" data-compv-mapping="clientDestroyFn" title="Delete"&gt; &lt;/span&gt;
  </code></pre>
  
  <p>Here is the JS:</p>
  
  <pre><code>$('[data-destroy-url]').live('click', function(e){
      console.debug("Clicked Destroy");
      var element = $(this);
      var mapping = compv.tools.getVariableFromString(element.attr("data-compv-mapping"), compv);
      var dialog = $("div#" + mapping.dialog);
      dialog.dialog('option', 'title', element.attr("data-destroy-title"));
      dialog.dialog("option", 
          "buttons", [
          { text: "No",
            click: function(){
              dialog.dialog('close');
          }
          },
      { text: "Yes, do it!",
        click: function() {
          dialog.dialog('close');
          $.destroy({
              url: element.attr('data-destroy-url'),
              success: mapping.success
          });
      }}
      ]);
      dialog.dialog('open');
  });
  </code></pre>
  
  <p>Btw, this only happens when <code>RAILS_ENV=production</code> and not <code>development</code>.</p>
  
  <p>Edit: Here is my application controller:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    helper :all
    helper_method :current_user, :logged_in?
  
    protect_from_forgery
    before_filter :set_current_user
    before_filter :authenticate_user!
  
    def set_xhr_flash
      flash.discard if request.xhr?
    end
  
    def correct_safari_and_ie_accept_headers
      ajax_request_types = ['text/javascript', 'application/json', 'text/xml']
      request.accepts.sort! { |x, y| ajax_request_types.include?(y.to_s) ? 1 : -1 } if request.xhr?
    end
  
    protected 
  
    def set_current_user
      logger.info current_user.inspect
      Authorization.current_user = current_user
      #User.current = current_user
    end
  
      # def after_sign_in_path_for(resource)
      #       if resource.is_a?(User) &amp;&amp; resource.has_trial_expired?
      #           return url_for(:settings)
      #       end
      #       super       
      #   end
  
  end
  </code></pre>
  
  <p>Edit2: When I tried to delete a stage (which is an object), I got this message in my log file:</p>
  
  <pre><code>Started POST "/stages/58" for 127.0.0.1 at 2011-04-20 23:18:13 -0500
    Processing by StagesController#destroy as JSON
    Parameters: {"id"=&gt;"58"}
    User Load (1.6ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 11 LIMIT 1
  nil
  Permission denied: No matching rules found for destroy for #&lt;Authorization::AnonymousUser:0x000001052659c0 @role_symbols=[:guest]&gt; (roles [:guest], privileges [:destroy], context :stages).
  Rendered text template (0.0ms)
  Completed 403 Forbidden in 232ms (Views: 0.9ms | ActiveRecord: 1.6ms)
  </code></pre>