406 Not Acceptable - xhr image upload to rails

I am trying to upload an image from iPhone to my working rails application that uses Carrierwave for processing. Do I need to account for the CSRF authenticity token that rails requires?

I have the following in my Titanium app.js file, taken pretty much from their Snapost example code:

xhr.open('POST','http://myapp.com/foos/1/bars');
xhr.send({media:originalImage});

My rails action is very simple:

def create
  @bar = @foo.bars.build(params[:bar])
  @bar.image = params[:file]    
  respond_to do |format|
    if @bar.save
      format.html { redirect_to(@foo, :notice => 'Bar was successfully created.') }
      format.json  { render :json => @bar, :status => :created }
      fotmat.xml { render :xml => @bar, :status => :created }
    else
      format.html { render :action => "new" }
      format.json { render :json => @bar.errors, :status => :unprocessable_entity }
      format.xml { render :xml => @bar.errors, :status => :unprocessable_entity }
    end
  end
end

From my device, I get the 'xhr.onerror' alert describing a timeout when I attempt an upload. My server log is as follows:

Started POST "/foos/1/bars" for ###.###.#.### at 2011-05-01 17:0开发者_如何学运维1:33 -0500 

Processing by BarsController#create as MULTIPART_FORM 

Parameters: {"media"=#<ActionDispatch::Http::UploadedFile:0xabdd968 @original_filename="285050.jpg", @content_type="image/jpeg", @headers="Content-Disposition: form-data; name=\"media\"; filename=\"2
85050.jpg\"\r\nContent-Type: image/jpeg\r\n", @tempfile=#<File:/tmp/RackMultipart20110501-32635-olgooh>>, "foo_id"=>"1"} 

^[[1m^[[36mSQL (1.9ms)^[[0m ^[[1mSHOW TABLES^[[0m 

^[[1m^[[35mFoo Load (0.1ms)^[[0m SELECT foos.* FROM foos WHERE foos.id = 1 LIMIT 1 

^[[1m^[[36mSQL (2.6ms)^[[0m ^[[1mBEGIN^[[0m 

^[[1m^[[35mSQL (5.9ms)^[[0m ROLLBACK 

Completed 406 Not Acceptable in 468ms

You are correct, it is the authenticity token (or lack there of) that is causing the problem. How do I ignore the authenticity token for specific actions in Rails? has more details on how to have it ignored. More details at http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html