This is an old-school way of handling this.  Rails now has built in [CSRF protection](http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf), which means it will generate the token for you.  jQuery ajax has a way of adding it to every request.

You'll need to [add the csrf meta tag](http://api.rubyonrails.org/classes/ActionView/Helpers/CsrfHelper.html) to your layout file.

Then, once, in JS, you'll need to tell AJAX to always send that along. Something like this:

```
var token = $( 'meta[name="csrf-token"]' ).attr( 'content' );
 
  $.ajaxSetup( {
    beforeSend: function ( xhr ) {
      xhr.setRequestHeader( 'X-CSRF-Token', token );
    }
  });
```