title: After successful sign-in, The following(subsequents) requests in angular side are unauthorized by rails server
body: <p>After Signin success by email auth, </p>
  
  <p>The following requests on Angular (js side) are unauthorized.</p>
  
  <p>I can not see the <code>token</code> in the success response by inspecting the response object in promise callback,</p>
  
  <p>But I can sure the server did return the token by inspecting the chrome console.</p>
  
  <p>And I guess those following requests didn't send the tokens as well.</p>
  
  <p>What's the buggy point? Thanks</p>
  
  <h1>successful email auth on <a href="http://localhost:3000/api/v1/auth/sign_in" rel="nofollow">http://localhost:3000/api/v1/auth/sign_in</a></h1>
  
  <pre><code>$auth.submitLogin({
    email: 'sample@gmail.com',
    password: '123'
  })
    .then(function(resp) {
      // handle success
      // I got User information but without token
      // {id: 1, provider: "email", uid: "sample@gmail.com", name: null, nickname: null…}
    })
  </code></pre>
  
  <p>I do the GET request in other controllers and got Unauthorized exception</p>
  
  <h1>Authentication on <a href="http://localhost:3000/api/v1/banks" rel="nofollow">http://localhost:3000/api/v1/banks</a></h1>
  
  <p>I got <code>401 (Unauthorized)</code></p>
  
  <pre><code>  app.controller('BanksIndexCtrl', function($scope, $resource, $q, bankService) {
        // this will raise Unauthorized exception
        $q.all([$scope.BankService.all().$promise]).then(function(ret){
          $scope.banks = ret[0]
        });
    });
  </code></pre>
  
  <p>Exception on console</p>
  
  <pre><code>      Started GET "/api/v1/banks" for 127.0.0.1 at 2016-04-22 22:51:47 +0800
        Processing by Api::V1::BanksController#index as JSON
        Filter chain halted as :authenticate_api_v1_user! rendered or redirected
        Completed 401 Unauthorized in 1ms (Views: 0.1ms | ActiveRecord: 0.0ms)
  </code></pre>
  
  <p>Request Header</p>
  
  <pre><code>    ```
      GET /api/v1/banks HTTP/1.1
      Host: localhost:3000
      Connection: keep-alive
      Pragma: no-cache
      Cache-Control: no-cache
      Accept: application/json, text/plain, */*
      If-Modified-Since: Mon, 26 Jul 1997 05:00:00 GMT
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
      Referer: http://localhost:3000/ngAdmin/admin.html
      Accept-Encoding: gzip, deflate, sdch
      Accept-Language: en-US,en;q=0.8
      Cookie: _session_id=2971e86420fb63b7a0d1de5c2fe97d88; remember_user_token=W1sxXSwiJDJhJDEwJE4xcWhrNVMvME51Um5GeGV5anc3UWUiLCIxNDYxMzM0NDMzLjk4ODQzODEiXQ%3D%3D--bcb30c131693a6ebdd638c835f7acdc4202abb66; _ga=GA1.1.381527585.1455597511; _sample_session=UitEN3l5WHNKdFpnV0dVWXYyUlRnYTlmdW9pUE9Oa0wydFFMWUw4c3E1Um5zaytsMmdZcy8wb01PbU9WOVA3dm9mRjUzLzRKdmQ1cmw0WDhsY0lPc3RGVTA3YUdSYm5sVXN6Rmpnd25EaU4rWTE3ZU9FakRYWHVyalJ3OTg4eGQ0RnhYWDRqMXRwazh6bmlRdk82eDM1ZzhYQk1lelRFSmVtZXc0ZTdsSGUzczJpSlhsenk0ZC9pK0k5d0wvRXpUNTNhenBsVzUwaVBONlFIOWQ5THR4MS9VS3BiQVF5NEhyVW1JNnF4N2prQXRkVGhpb2psZEZTdHNoelN2L1VzWTVBTVQ2VzlKcnE5N0I5OWVGRUlmbHFyb3NTTUZ6cHZwc2UwbW4wMWgranR4YTJHZ3V6Nm1CTVNVUTllditFMktNbDBGODNucUcydHYzT3Q1eEZyaTlnPT0tLTg4bXVLa1lFZ1NER1J6RFhGWFNyaXc9PQ%3D%3D--97b510524e0a6b970ef6ad26d87d83fadb80f51c
  
      ```
  </code></pre>
  
  <h1>routes.rb</h1>
  
  <pre><code>Rails.application.routes.draw do
    devise_for :users  , :controllers =&gt; {:registrations =&gt; "registrations"}
    namespace :api do
      namespace :v1, defaults: {format: 'json'} do
        mount_devise_token_auth_for 'User', at: 'auth', controllers: {
          sessions: 'token_sessions'
        }
    ...      
  </code></pre>
  
  <h1>api/v1/banks.rb</h1>
  
  <pre><code>class Api::V1::BanksController &lt; ApplicationController
    skip_before_action :protect_from_forgery
    protect_from_forgery with: :null_session, only: Proc.new { |c| c.request.format.json? }
    before_filter :authenticate_api_v1_user!
    ...
  </code></pre>
  
  <h1>application.rb</h1>
  
  <pre><code>config.middleware.insert_before 0, "Rack::Cors" do
    allow do
      origins '*'
      resource '*',
        :headers =&gt; :any,
        :methods =&gt; [:get, :post, :delete, :put, :options, :head],
        :expose  =&gt; ['access-token', 'expiry', 'token-type', 'uid', 'client'],
        :max_age =&gt; 0
    end
  end
  </code></pre>
  
  <h1>Angular App  config</h1>
  
  <pre><code>app.config(function($authProvider) {
      $authProvider.configure({
          apiUrl: '/',
          tokenValidationPath: 'api/v1/auth/validate_token',
          signOutUrl: 'api/v1/auth/sign_out',
          emailRegistrationPath: 'api/v1/auth',
          accountUpdatePath: 'api/v1/auth',
          accountDeletePath: 'api/v1/auth',
          confirmationSuccessUrl: window.location.href,
          passwordResetPath: 'api/v1/auth/password',
          passwordUpdatePath: 'api/v1/auth/password',
          passwordResetSuccessUrl: window.location.href,
          emailSignInPath: 'api/v1/auth/sign_in',
          storage: 'cookies',
          forceValidateToken: false,
          validateOnPageLoad: true,
          proxyIf: function() {
              return false;
          },
          proxyUrl: '/proxy',
          omniauthWindowType: 'sameWindow',
          authProviderPaths: {
              sample: 'api/v1/auth/sample',
              github: 'api/v1/auth/github',
              facebook: 'api/v1/auth/facebook',
              google: 'api/v1/auth/google'
          },
          tokenFormat: {
              "access-token": "{{ token }}",
              "token-type": "Bearer",
              "client": "{{ clientId }}",
              "expiry": "{{ expiry }}",
              "uid": "{{ uid }}"
          },
          cookieOps: {
              path: "/",
              expires: 9999,
              expirationUnit: 'days',
              secure: false,
              domain: 'domain.com'
          },
          createPopup: function(url) {
              return window.open(url, '_blank', 'closebuttoncaption=Cancel');
          },
          parseExpiry: function(headers) {
              // convert from UTC ruby (seconds) to UTC js (milliseconds)
              return (parseInt(headers['expiry']) * 1000) || null;
          },
          handleLoginResponse: function(response) {
              return response.data;
          },
          handleAccountUpdateResponse: function(response) {
              return response.data;
          },
          handleTokenValidationResponse: function(response) {
              return response.data;
          }
      });
  });
  </code></pre>