gistfile1.txt

	<%= javascript_tag "var auth_token = #{form_authenticity_token.inspect};" if protect_against_forgery? %>

results in:
//<![CDATA[
var auth_token = "ZOqYXojCWdc5FZlFY11sHtDW4dnC9eh2/G2M7PcDEDY=";
//]]>
</script>


When called like:
	$j('#image-wall a.delete.remote').live("click", function () {
		if (confirm('Are you sure?')) {    	
    	$j.post(this.href, { photo_id: $j(this).parents("li").attr("id").split("_")[1], authenticity_token: auth_token }, null, "script");  
    	return false;
		}
		return false;
	});

Has spaces in the authenticity_token where "+" would be.