config Devise to respond to JSON requests; skip CSRF token verification on Users#create; add API_TOKEN environment variable