I think the problem is that sso-ux.js sends an XHR to /user/:email but it doesn't attach the CSRF token. What if you added the CSRF token to the rendered template, then had sso-ux.js look for <meta name="csrf-token" value="asdfasdf"> ?