[eluser]Chillahan[/eluser]
Good point on the update, no need to declare an ajax request constant when the method is there now.
On the CSRF - if you edit the time value in the security library, you can set it to whatever. I find that when set to 1 second, it causes a lot of problems, apparently it doesn't really handle a constantly changing id too well (even though it does implicitly trust the cookie's value - actually, it is BECAUSE it trusts the cookie's value, but the cookie has since expired, so basically the same problem as for ajax requests).
So my overall questions still stand - why is CI not setting cookies during ajax requests, when I can set a cookie via the set_cookie helper?
And assuming it could, wouldn't that fix all problems with the session and csrf features during ajax requests?
