I tried out adding the exclude line:
protect_from_forgery :only => [:tag]
However, it seems ugly that I have to add each method manually. I tried
protect_from_forgery :exclude => [:auto_complete_for_tag_name]
but that didn't work. Is this oddness a) a bug or b) just something the docs for the plugin should discuss?