I was getting a ActionController::InvalidAuthenticityToken destroy error when using the Destroy method in my Rails 3 app. Turns out, when I was migrating to Rails 3, I forgot to include this in the html header:-

I couldn't find a solution anywhere, so hopefully this helps you out!