simple auth with devise and rails backend csrf