This is one way to add csrf-token to your request from elm to rails. This is general solution, I use it with rails.

add_csrf_token_to_request.js

(function(){
  var send = XMLHttpRequest.prototype.send,
      token = document.querySelector("meta[name=csrf-token]").getAttribute("content");
  XMLHttpRequest.prototype.send = function(data){
    this.setRequestHeader('X-CSRF-Token', token);
    return send.apply(this, arguments);
  }
})();

console.log("csrf-token: " + document.querySelector("meta[name=csrf-token]").getAttribute("content"))

// To test that it works
// var xhr = new XMLHttpRequest();
xhr.open('POST', '/api/v1/events', true);
xhr.onload = function () {
  console.log("Request finished. Do processing here.");
};
xhr.setRequestHeader("Content-type", "application/json; charset=utf-8");
xhr.send('{"event":{"projectId":10,"users":[1,2]}}');

// Thanks to Louis Simoneau & Rahul Trikha
// Taken from there talk on Elm, at RubyConf AU 2017 
// https://youtu.be/Bd6DTg1uNe0?t=27m58s