zooniverse/Panoptes — pull request #101 by edpaget (2014-07-15 19:40:44+00:00)
Title: First party login

Hey all, this should handle user login and retrieving the OAuth token for sites on the *.zooniverse.org domain.

Basically the main thrust is that it allows a devise session cookie to be substituted for users credentials when making a request to the `/oauth/token` endpoint. So if a client is on a *.zooniverse.org domain, and a user is signed in using devise sending a request like...

```json
{
"grant_type": "password",
"client_id": "asdk;fja;sdfqwklj;laskdfja;sdlfkj..."
}
```

...returns a fully scoped OAuth token for the site.

It also adds support for managing a devise session over JSON.

The only caveat is all of those endpoints need to use Rails's CSRF protection features to prevent a third-party site from ohijacking a users's session and getting free oauth tokens. Therefore the javascript client will need to look for the `X-CSRF-Param` and `X-CSRF-Token` headers and respond with a `X-CSRF-Token` header.