fix replace miss
use Devise.sign_out_via instead of fixed :delete
avoid "Can't verify CSRF token authenticity" via API