Moved rescue_from for CanCan::AccessDenied to ApiController. Seems to be caught properly there but not in ApplicationController.
Added controller test with token authentication helper to sign in a user. Configured Apipie to extract example json data from offers/1 test and show in API docs.