Create Rails Authentication Token with iFrame or Facebook

Rails CSRF authentication token is known to not work inside iframe or Facebook canvas. Iframe Reasons Cannot Authenticate CSRF n Rails Authentication

The recommended solution turns it off. However, I am getting bots automatically submitting our nested form. I would like to have some sort of CSRF protection without having to resort to captcha.

Is there anyway to get the rails token to work inside or iframe or is there a better solution out there? Thanks to