application_controller.rb

# Track request logging during development
  around_filter :global_request_logging

  def global_request_logging
    logger.info "=> USERAGENT: #{request.headers['HTTP_USER_AGENT']}"
    logger.info "=> REQUEST_FORMAT: #{request.format}"
    begin
      yield
    ensure
      logger.info "=> RESPONSE_STATUS: #{response.status}"
    end
  end

csrf.log

Started POST "/users/sign_in" for xxx.xxx.xxx.xxx at 2014-01-29 15:59:44 -0500
Processing by Users::SessionsController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"Ol8wIWY5uebgDiC2+frSeVAgzqYLh7BfHk5ATXsAplk=", "user"=>{"email"=>"[email protected]", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Join Domain"}
=> USERAGENT: Mozilla/5.0 (Linux; U; Android 4.0.3; en-us; ADR6425LVW 4G Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
=> REQUEST_FORMAT: text/html
Can't verify CSRF token authenticity
=> RESPONSE_STATUS: 422
Completed 422 Unprocessable Entity in 5ms
ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):


** This only occurs if I use skip_before_filter :verify_authenticity_token, :only => :create

** If I use the other skip_before_filter posted in sessions below, it works fine.

routes.rb

devise_for :users, :controllers => { :omniauth_callbacks => "users/omniauth_callbacks", :sessions => "users/sessions", :registrations => "users/registrations" }
  

sessions_controller.rb

class Users::SessionsController < Devise::SessionsController

  skip_authorization_check #cancan

  # This does not work
  #skip_before_filter :verify_authenticity_token, :only => :create

  # This works below
  skip_before_filter :verify_authenticity_token, :if => Proc.new { |c| c.request.format == 'text/html' }

end