Rails authenticity_token on a form vs csrf token
<p>On same page of a rails 4 app I have a</p>

<p>in the head:</p>

<pre><code>&lt;meta name="csrf-param" content="authenticity_token" /&gt;
&lt;meta name="csrf-token" content="some_token" /&gt;
</code></pre>

<p>and below in the body:</p>

<pre><code>&lt;form action="/someaction" method="post"&gt;
&lt;input name="utf8" type="hidden" value="&amp;#x2713;" /&gt;
&lt;input type="hidden" name="_method" value="patch" /&gt;
&lt;input type="hidden" name="authenticity_token" value="another_token" /&gt;
</code></pre>

<p>The csrf token is need for js calls. But why is the form token different from the csrf token? Which of the two tokens is used on form submission?</p>