 
   _getAuthToken: ->
     console?.log 'Getting auth token'
-    makeHTTPRequest 'GET', config.host + '/', null, 'Accept': 'text/html', ADD_CREDENTIALS
+    makeHTTPRequest 'GET', config.host + '/', null, 'Accept': 'text/html'
       .then (request) ->
         [_, authTokenMatch1, authTokenMatch2] = request.responseText.match CSRF_TOKEN_PATTERN
         authToken = authTokenMatch1 ? authTokenMatch2

JSON_HEADERS =
  'Content-Type': 'application/json'
  'Accept': 'application/json'

ADD_CREDENTIALS = (request) ->
  request.withCredentials = true

# This will match the CSRF token in a string of HTML.
# TODO: Get JSON instead.

        authenticity_token: token

      # PhantomJS doesn't send any data with DELETE, so fake it here.
      deleteOverrideJSONHeaders = Object.create JSON_HEADERS
      deleteOverrideJSONHeaders['X-HTTP-Method-Override'] = 'DELETE'

      makeHTTPRequest 'POST', config.host + '/users/sign_out', data, deleteOverrideJSONHeaders
        .then =>
          @_deleteBearerToken()
          null
