You need to `protect_from_forgery with: :exception`.  

If you don't know how to do this with AJAX, read [this about CSRF in Rails](http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf).
Then you can set a `beforeSend` [for all jQuery AJAX requests](https://gist.github.com/benschwarz/5333009).