class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  before_filter :configure_permitted_devise_params, if: :devise_controller?

  protected

  def configure_permitted_devise_params
    devise_parameter_sanitizer.for(:sign_up) << :name
    devise_parameter_sanitizer.for(:account_update) << :name
  end

  def authorize(condition)
    unless condition
      render 'errors/unauthorized', :status => :unauthorized
    end
  end

  def can?(action, object)
    user_signed_in? && current_user.can?(action, object)
  end

end

class ApplicationController < ActionController::Base

  protect_from_forgery

  before_filter :configure_permitted_devise_params, if: :devise_controller?

  protected

  def configure_permitted_devise_params
    devise_parameter_sanitizer.for(:sign_up) << :name
    devise_parameter_sanitizer.for(:account_update) << :name
  end

  def authorize(condition)
    unless condition
      render 'errors/unauthorized', :status => :unauthorized
    end
  end

  def can?(action, object)
    user_signed_in? && current_user.can?(action, object)
  end

end

Stop forgery protection from raising exceptions in API calls.
Stop forgery protection from raising exceptions in API calls.

API calls don't have the CSRF tokens but are legit so allow them to happen in a
null session. They are authenticated every time, so they don't need a real
session.
