class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception, prepend: true
  before_action :authenticate_user!

  def layout_by_resource
    if devise_controller? and !user_signed_in?
      'devise'
    else
      'application'
    end
  end
end

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception, prepend: true
  before_action :authenticate_user!

  def layout_by_resource
    if devise_controller? and !user_signed_in?
      'devise'
    else
      'application'
    end
  end

  # See "Gracefully handling InvalidAuthenticityToken exceptions"
  # Phase 1 (2nd variation): https://stackoverflow.com/a/36533724/6875981
  def handle_unverified_request
    flash[:error] = 'Unverified request. Please retry or clear your cookie!'
    redirect_to :back
  end
end

Add graceful auth token exception handling
Add graceful auth token exception handling

Source: https://stackoverflow.com/a/36533724/6875981

Phase 1 (2nd variation)
Another way to go about is just redirect Alice back to the form which she submitted without any pre-filled values.

This approach can be achieved by:

1) ApplicationController - Add this function:

```
def handle_unverified_request
    flash[:error] = 'Kindly retry.'
    redirect_to :back
end
```
