sessions_controller.rb

class Api::SessionsController < ApplicationController
  before_action :current_user, except: :create

  def show
    render json: @user, serializer: UserSerializer
  end

  def create
    @auth = false
    if params[:password].present?
      @user = User.where(email:params[:email]).first if params[:email].present?
      if @user && @user.authenticate(params[:password])
        @auth = true
      end
    else

      authenticate_with_http_token do |token, options|
        @user = User.where(auth_token: token).first
        @user.type.constantize.find(@user.id)
        @auth = true
      end
    end

    if @auth
      render json:  UserTokenSerializer.new(@user)
    else
      render nothing: true, status: 403
    end
  end
end