setting XSRF token in cookies
protect_from_forgery :null_session
added devise json routes