let json_csrf always deny, fixes #50

rack-protection/lib/rack/protection/json_csrf.rb

@@ -11,7 +11,7 @@ module Rack
     # Array prototype has been patched to track data. Checks the referrer
     # even on GET requests if the content type is JSON.
     class JsonCsrf < Base
-      default_reaction :deny
+      alias react deny
 
       def call(env)
         request               = Request.new(env)

rack-protection/spec/json_csrf_spec.rb

@@ -44,7 +44,7 @@ describe Rack::Protection::JsonCsrf do
   end
 
   describe 'with drop_session as default reaction' do
-    it 'reset the session' do
+    it 'still denies' do
       mock_app do
         use Rack::Protection, :reaction => :drop_session
         run proc { |e| [200, {'Content-Type' => 'application/json'}, []]}
@@ -52,8 +52,7 @@ describe Rack::Protection::JsonCsrf do
 
       session = {:foo => :bar}
       get('/', {}, 'HTTP_REFERER' => 'http://evil.com', 'rack.session' => session)
-      last_response.should be_ok
-      session.should be_empty
+      last_response.should_not be_ok
     end
   end
 end