recover from bad CSRF tokens without requiring a hard refresh of the browser

app/controllers/application_controller.rb

@@ -22,7 +22,7 @@ class ApplicationController < ActionController::Base
     unless is_api?
       super
       clear_current_user
-      raise Discourse::CSRF
+      render text: "['BAD CSRF']", status: 403
     end
   end
 

app/controllers/session_controller.rb

@@ -67,7 +67,7 @@ class SessionController < ApplicationController
   end
 
   def destroy
-    session[:current_user_id] = nil
+    reset_session
     cookies[:_t] = nil
     render nothing: true
   end

app/controllers/users/omniauth_callbacks_controller.rb

@@ -83,6 +83,8 @@ class Users::OmniauthCallbacksController < ApplicationController
     # log on any account that is active with forum access
     if Guardian.new(user).can_access_forum? && user.active
       log_on_user(user)
+      # don't carry around old auth info, perhaps move elsewhere
+      session[:authentication] = nil
       @data.authenticated = true
     else
       if SiteSetting.invite_only?