I ran into an issue described here

http://stackoverflow.com/questions/9362910/rails-warning-cant-verify-csrf-token-authenticity-for-json-devise-requests

Sign in, then out, then back in fails because the csrf token has expired (or something). I noticed you solved this by signing out using :get in your devise.rb initializer. Which is described as being a bad idea here:

http://stackoverflow.com/questions/941594/understand-rails-authenticity-token

I was wondering if you have found a more secure method, as suggested in the SO question?
Overriding and passing a new token each request seems like the best idea. Though, I am still unsure the best way to go about implementing it.

P.S.
Cheers, for this project. It is the best example of how to interact with Devise over json that I could find.

Hi Josh,

Thanks for this, I am reasonaby comfortable with Backbone now, just moving onto Marionette and this seems to be a great project to pick apart to learn it.

Just curious as to why when I delete out the javascript and css from /public/assets, all the login functionality stops working.

Work when it is in there, fails when it is gone.

I am trying various things, such as including all the required js files from a ./utils folder in /assets/javascripts but no joy.

I can't see how some of the files such as ( I changed to coffeescript)

= require underscore

= require underscore.string

= require backbone

= require backbone.sync.rails

= require backbone.modelbinder

= require backbone.marionette

are being included.

There seems to be no gems that load these into the asset pipeline.

I am missing something obvious I think.

Any thoughts/suggestions?

Cheers,

Luke