Authentication tokens now included in all DELETE, POST and PUT calls via link_to. Had to move the <%= csrf_meta_tag %> directive from application.html.erb layout which was not actually used to _head.html.erb referenced from the actual layout appliation_wide.