class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
  before_action :configure_permitted_parameters, if: :devise_controller?
  before_action :authenticate_user!

  helper_method :correct_user?

  def correct_user?(object)
    current_user == object.user
  end

  protected

    def configure_permitted_parameters
      devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
    end
end

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
  before_action :configure_permitted_parameters, if: :devise_controller?
  before_action :authenticate_user!
  before_action :response_headers

  helper_method :correct_user?

  def correct_user?(object)
    current_user == object.user
  end

  protected

    def configure_permitted_parameters
      devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
    end

    def response_headers
      response.headers["Vary"]= "Accept"
    end
end

Stop browser caching json on browser back.
Stop browser caching json on browser back.
