This may very well be a case of me holding it wrong, but I'm wondering if this is an overlooked case that Rails should handle gracefully, or if it's up to the user to fix.

Basically, some things like CSRF tokens and flashes live in the session, and involve mutable state. CSRF tokens are lazily generated and put in the session when you call form_authenticity_token, and the Flash object is lazily created and swept when you access the flash API, also typically during rendering.

If you're using streaming rendering (render :stream => true), this means the session is being modified after it is serialized and sent as a Set-Cookie header, if you are using the cookie store. This means you get races where flash messages persist forever, and forms cannot be submitted.

I am currently fixing them by adding the following to ApplicationController for force-generate these values before the headers are sent:

before_filter :form_authenticity_token
before_filter :flash

Should Rails handle this transparently, or is it on me to fix it, and if the latter, is there a better way of fixing it?