fix #1125 where rest/xml request were being rejected by the new csrf code of rails

app/controllers/application_controller.rb

@@ -185,6 +185,12 @@ class ApplicationController < ActionController::Base
     return saved ? todo : nil
   end
 
+  def handle_unverified_request
+    unless request.format=="application/xml"
+      super # handle xml http auth via our own login code
+    end
+  end
+
   protected
   
   def admin_login_required