I'm building an API using Rails and Devise. My sessions controller inherits from the following base controller

```
api/base_controller.rb 

module Api
  class BaseController < ApplicationController
    skip_before_filter  :verify_authenticity_token
    before_filter :authenticate_user_from_token!
    respond_to :json

    private

    def authenticate_user_from_token!
        user_token = params[:auth_token].presence
        user       = user_token && User.find_by_authentication_token(user_token)

        if user
          sign_in user, store: false
        else
          render :json => {:success => false, :message => "Error with your credentials",     :status => 401}
        end
    end
  end
end

```

My sessions controller's destroy action below:

```
api/sessions_controller.rb

before_filter :authenticate_user_from_token!, :except => [:create]

def destroy
  current_user.reset_authentication_token
  render :json => {
    :success => true,
    :status => 200
  }
end

```

This works perfectly when testing the api via curl. But, I can't get my Rspec tests for the destroy action to pass. From Rspec the sign\_in user call is failing, so the response is a redirect. I haven't had any success trying to stub the sign\_in method.

Rspec test:

```
describe "DELETE destroy" do
  before(:each) do
    @user1 = User.create!(:email => 'example@gmail.com', :password => 'helloworld', :password_confirmation => 'helloworld')
  end

  it "should render success json" do
    delete :destroy, :auth_token => @user1.authentication_token
    json = JSON.parse(response.body)
    json.should include('success' => true, 'status' => 200)
  end

  ###this fails because the response is a redirect to the sign_in page
end

```

How should I go about mocking the sign\_in method called from within the base controller?