title: devise_token_auth always returns 401 Unauthorized
body: <p>I'm working on an Angular app with a Rails API. I'm using <a href="https://github.com/lynndylanhurley/devise_token_auth" rel="nofollow noreferrer">Devise Token Auth</a> and the <a href="https://github.com/neroniaky/angular2-token/tree/6.x" rel="nofollow noreferrer">6.x branch of angular-token</a>. I can CRUD users with no problem, and I can sign in, but when I try to access a restricted resource (one restricted through the <code>before_action :authenticate_user!</code> helper), I get an error regardless of whether I'm signed in or not.</p>
  
  <p><strong>Relevant controller</strong>:</p>
  
  <pre><code>class QuestionsController &lt; ApplicationController
      before_action :authenticate_user!
  
      # GET /questions.json
      def index
        @questions = Question.all
  
        # This code is never reached due to the :authenticate_user! helper, 
        # but when I comment it out, I get the following:
        puts user_signed_in?  # =&gt; false
        puts current_user     # =&gt; nil
  
        render json: @questions
      end
  </code></pre>
  
  <p>A few things:</p>
  
  <ul>
  <li>I'm definitely signed in according to <code>angular-token</code> -- <code>TokenService.UserSignedIn()</code> returns <code>true</code> at the time of the <code>401 Unauthorized response</code>.</li>
  <li>I've enabled CORS.</li>
  <li>I've exposed the following headers in the rack-cors config: <code>['access-token', 'expiry', 'token-type', 'uid', 'client']</code>.</li>
  </ul>
  
  <p>Any help would be greatly appreciated.</p>
  
  <p><strong>Example response from signin</strong>:</p>
  
  <pre><code>{
      "data": {
          "id": 1,
          "email": "me@example.com",
          "provider": "email",
          "uid": "me@example.com",
          "allow_password_change": false,
          "name": null,
          "nickname": null,
          "image": null
      }
  }
  </code></pre>
  
  <p><strong>Angular code</strong>:</p>
  
  <pre><code>this.authService.loginUser({
    login: '',
    password: ''
  })
  .subscribe(resp =&gt; {
      if (resp.status === 200) {
        this.router.navigate(['/']);
      }
    },
    err =&gt; {
      // cut for brevity
  });
  </code></pre>
  
  <p><strong>Edit</strong>:</p>
  
  <p>I've figured out the problem is with <code>angular-token</code> not setting the auth headers due to what I believe to be a bug in the following code:</p>
  
  <pre><code>// Add the headers if the request is going to the configured server
  if (this.tokenService.currentAuthData &amp;&amp; req.url.match(this.tokenService.apiPath)) {
    (&lt;any&gt;Object).assign(baseHeaders, {
      'access-token': this.tokenService.currentAuthData.accessToken,
      'client':       this.tokenService.currentAuthData.client,
      'expiry':       this.tokenService.currentAuthData.expiry,
      'token-type':   this.tokenService.currentAuthData.tokenType,
      'uid':          this.tokenService.currentAuthData.uid
    });
  }
  </code></pre>
  
  <p>Since I don't have <code>apiPath</code> defined, <code>req.url.match(this.tokenService.apiPath))</code> is evaluated to <code>false</code> and thus, the headers are never added.</p>