Why are you turning this off?  This is super important for the security of your app.

According to the [angular documentation](https://docs.angularjs.org/api/ng/service/$http), you'll just need to put the [csrf token](http://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf) that Rails generates into a cookie.

> XSRF is a technique by which an unauthorized site can gain your user's private data. Angular provides a mechanism to counter XSRF. When performing XHR requests, the $http service reads a token from a cookie (by default, XSRF-TOKEN) and sets it as an HTTP header (X-XSRF-TOKEN). Since only JavaScript that runs on your domain could read the cookie, your server can be assured that the XHR came from JavaScript running on your domain. The header will not be set for cross-domain requests.
>
>To take advantage of this, your server needs to set a token in a JavaScript readable session cookie called XSRF-TOKEN on the first HTTP GET request.