title: Code from application_controller.rb is not inherited by other controllers
body: <p>I read that the use of the <code>ApplicationController</code> is to treat it like the parent of all other controllers. Any code that goes into it will also run in all other controllers. Because I use my app more like an API I put <code>skip_before_action :verify_authenticity_token</code> in my application_controller.rb file so I can utilize my app from external domains. For some reason it does not work (it still blocks the connection). Instead I had to put that line of code into every single controller to make it work (authentication is now skipped / app can be utilized by external domains).</p>
  <p>While it isn't much trouble to put the code in every conroller I'm confused about the correct usage of the ApplicationController and wonder if I did something wrong.</p>
  <p>Any help is much appreciated! :)</p>
  <p>Here is the code of the <code>ApplicationController</code></p>
  <pre><code>class ApplicationController &lt; ActionController::Base
    skip_before_action :verify_authenticity_token
  end
  </code></pre>
  <p>Here is the code of another controller (Note: the <code>skip_before_action :verify_authenticity_token</code> should be removed / inherited by the <code>ApplicationController</code> as dscribed above.</p>
  <pre><code>class SessionsController &lt; ActionController::Base
    include CurrentUserConcern
  
    skip_before_action :verify_authenticity_token
  
    def create
      user = User.find_by(email: params[&quot;user&quot;][&quot;email&quot;]).try(:authenticate, params[&quot;user&quot;][&quot;password&quot;])
  
      if User
        session[:user_id] = user.id
        render json: {
          status: :created,
          logged_in: true,
          user: user
        }
      else
        render json: {
          status: 401
        }
      end
    end
  
    def logged_in
      if @current_user
        render json: {
          logged_in: true,
          user: @current_user
        }
      else
        render json: {
          logged_in: false
        }
      end
    end
  
    def logout
      reset_session
      render json: {
        status: 200,
        logged_out: true
      }
    end
  end
  </code></pre>