Post listing to rails app with Devise token-authenticable from Objective-C

listing.c

// QUESTION: For some reason Devise only sees auth token when passed through url not as param
// WHY? this seems really insecure...

-(NSString *) concatURL {
    NSString *base = @"http://localhost:3000";
    NSString *auth = [[NSUserDefaults standardUserDefaults] objectForKey:@"token"];
    return [NSString stringWithFormat:@"%@?auth_token=%@", base, auth];
}

-(NSDictionary *) postListing {
    NSError *error;
    NSData *json = [NSJSONSerialization dataWithJSONObject:[self prepareAsDictionary]
                                                   options:kNilOptions error:&error];
    
    NSURL *url = [NSURL URLWithString:[self concatURL]];
    NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url];
    [request setHTTPMethod:@"POST"];
    [request setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
    [request setValue:@"application/json" forHTTPHeaderField:@"Accept"];
    [request setHTTPBody:json];
    
    NSURLResponse *response;
    NSData *responseData = [NSURLConnection sendSynchronousRequest:request
                                                 returningResponse:&response 
                                                             error:&error];
    NSDictionary *dict_response = [NSJSONSerialization JSONObjectWithData:responseData 
                                                                  options:kNilOptions 
                                                                    error:&error];
    NSLog(@"%@", dict_response);
    return dict_response;
}