title: devise user sign_in gives authentication error for CSRF token authenticity token
body: <p>I am using <code>devise</code> (latest version - 3.2.0) with <code>rails</code> (latest version - 4.0.1)</p>
  
  <p>I'm doing simple authentication (without ajax or api) and getting an error for CSRF authenticity token. Check the POST request below</p>
  
  <pre class="lang-none prettyprint-override"><code>started POST "/users/sign_in" for 127.0.0.1 at 2013-11-08 19:48:49 +0530
  Processing by Devise::SessionsController#create as HTML
  
   Parameters: {"utf8"=&gt;"✓",    
   "authenticity_token"=&gt;"SJnGhXXUXjncnPhCdg3muV2GYCA8CX2LVFV78pqddD4=", "user"=&gt; 
  {"email"=&gt;"a@a.com", "password"=&gt;"[FILTERED]", "remember_me"=&gt;"0"},
  "commit"=&gt;"Sign in"}
  
  Can't verify CSRF token authenticity
   User Load (0.4ms)  SELECT "users".* FROM "users" WHERE "users"."email" =  
  'a@a.com' LIMIT 1
  (0.1ms)  begin transaction
  SQL (0.4ms)  UPDATE "users" SET "last_sign_in_at" = ?, "current_sign_in_at" = ?,
  "sign_in_count" = ?, "updated_at" = ? WHERE "users"."id" = 2  [["last_sign_in_at", Fri,
  08 Nov 2013 14:13:56 UTC +00:00], ["current_sign_in_at", Fri, 08 Nov 2013 14:18:49 UTC
  +00:00], ["sign_in_count", 3], ["updated_at", Fri, 08 Nov 2013 14:18:49 UTC +00:00]]
  (143.6ms)  commit transaction
  Redirected to http://localhost:3000/
  Completed 302 Found in 239ms (ActiveRecord: 144.5ms | Search: 0.0ms)
  </code></pre>
  
  <p>The root url points to <code>home#new</code>, which is like</p>
  
  <pre><code>class HomeController &lt; ApplicationController
     before_action :authenticate_user!
     def index
     end
  end
  </code></pre>
  
  <p>Sign_in page generated html view is like:</p>
  
  <ul>
  <li><p>meta tags</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;meta content="authenticity_token" name="csrf-param" /&gt;
  &lt;meta content="aV+d7Z55XBJF2VtyL8V3zupR3OwhaQ6UHNtlQLBQf5Y=" name="csrf-token" /&gt;
  </code></pre></li>
  <li><p>form</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;form accept-charset="UTF-8" action="/users/sign_in" class="new_user" id="new_user" 
  method="post"&gt;
  &lt;div style="margin:0;padding:0;display:inline"&gt;
  &lt;input name="utf8" type="hidden" value="&amp;#x2713;" /&gt;
  &lt;input name="authenticity_token" type="hidden
  value="aV+d7Z55XBJF2VtyL8V3zupR3OwhaQ6UHNtlQLBQf5Y=" /&gt;
  &lt;/div&gt;
  &lt;div&gt;&lt;label for="user_email"&gt;Email&lt;/label&gt;&lt;br /&gt;
  &lt;input autofocus="autofocus" id="user_email" name="user[email]" type="email" value="" /&gt;
  &lt;/div&gt;
  
  &lt;div&gt;&lt;label for="user_password"&gt;Password&lt;/label&gt;&lt;br /&gt;
  &lt;input id="user_password" name="user[password]" type="password" /&gt;&lt;/div&gt;
  
  &lt;div&gt;&lt;input name="user[remember_me]" type="hidden" value="0" /&gt;
  &lt;input id="user_remember_me" name="user[remember_me]" type="checkbox" value="1" /&gt; 
  &lt;label for="user_remember_me"&gt;Remember me&lt;/label&gt;&lt;/div&gt;
  
  &lt;div&gt;&lt;input name="commit" type="submit" value="Sign in" /&gt;&lt;/div&gt;
  &lt;/form&gt;
  </code></pre></li>
  </ul>
  
  <p>The authentication request even updates the <code>last_sign_in_at</code> and <code>sign_in_count</code> values, but when I try to access <code>current_user</code> in controller it comes as <code>nil</code>.</p>
  
  <p>According to me it is not actually signing in <code>user</code>. But then question comes "why it is updating <code>last_sign_in_at</code>/<code>sign_in_count</code> value in the <code>user</code> table ?"</p>