PgHero gem allows CSRF

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protectfromforgery method from Rails to prevent CSRF. However, this defaults to :nullsession, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based...