csrf_for_ember.rb

class Admin::Api::BaseController < Admin::BaseController
  after_filter :set_csrf_cookie

  # For client side js applications needing to qualify for Rails CSRF protection
  # Normally rails will return its csrf token in the body of the request for html rendering
  #
  # In the case of client side apps, we return the token in a cookie
  # See: https://technpol.wordpress.com/2014/04/17/rails4-angularjs-csrf-and-devise/
  def set_csrf_cookie
    cookies['X-CSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
  end

  private

  # Allow client side apps to set CSRF tokens in headers
  def verified_request?
    super || form_authenticity_token == request.headers['X-CSRF-TOKEN']
  end
end