recover from bad CSRF tokens without requiring a hard refresh of the browser

app/controllers/application_controller.rb

@@ -22,7 +22,7 @@ class ApplicationController < ActionController::Base
     unless is_api?
       super
       clear_current_user
-      raise Discourse::CSRF
+      render text: "['BAD CSRF']", status: 403
     end
   end