HTTP GET is not CSRF safe in Rails

Nor in Django, right? HTTP GET requests shouldn't have side effects.

Link to the code snippet that checks the token: https://github.com/rails/rails/blob/master/actionpack/lib/ac...