Pass CSRF token in event creation.

app/controllers/events_controller.rb

@@ -8,7 +8,7 @@ class EventsController < ApplicationController
   def index
     respond_to do |format|
       format.js do
-        json = events.to_json(eager_options(:root => "events", :include => { :tagged_items => { :only => [:amount, :id], :methods => :name }, :line_items => { :only => [:account_id, :bucket_id, :amount, :role], :methods => [] }}))
+        json = events.to_json(eager_options(:root => "event", :include => { :tagged_items => { :only => [:amount, :id], :methods => :name }, :line_items => { :only => [:account_id, :bucket_id, :amount, :role], :methods => [] }}))
 
         render :update do |page|
           page << "Events.doneLoadingRecalledEvents(#{json})"

public/javascripts/events.js

@@ -469,6 +469,9 @@ var Events = {
 
       options.method = "post";
       options.contentType = "application/xml";
+      options.requestHeaders = {
+        'X-CSRF-Token': $F(form['authenticity_token'])
+      };
       options.postBody = Events.buildXMLStringFor(Events.serialize(form));
 
       return new Ajax.Request(action, options);