title: Doorkeeper::AuthorizationsController#create Can't verify CSRF token authenticity
body: <p>I followed the page <a href="https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Resource-Owner-Password-Credentials-flow" rel="nofollow">https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Resource-Owner-Password-Credentials-flow</a> by testing the API </p>
  
  <pre><code>curl -F grant_type=password \
  -F username=foo@bar.com \
  -F password=mypass \
  -X POST http://localhost:3000/oauth/token
  </code></pre>
  
  <p>And I got the response:        </p>
  
  <blockquote>
    <p>{"access_token":"6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440","token_type":"bearer","expires_in":600,"refresh_token":"c1445d0a27a8278268c1187c2e3da7163525f1fac8093890430edd328f51c3de","created_at":1429931390}</p>
  </blockquote>
  
  <p>But when I call /oauth/authorize with:</p>
  
  <p><code>curl -F response_type=6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440 \
  -F client_id=9c291dc4aa87bfafd6c6a4cf6930d225c106f8fe88e1d0769832047f1ee011c4 \
  -F client_secret=decba5aca425095978d33653ef03d654f0b74427bcec0596bdde518016708c35 \
  -F redirect_uri=urn:ietf:wg:oauth:2.0:oob \
  -F username=foo@bar.com \
  -X POST http://localhost:3000/oauth/authorize
  </code></p>
  
  <p>But I got:</p>
  
  <blockquote>
    <p>Started POST "/oauth/authorize" for 127.0.0.1 at 2015-04-25 00:30:05 -0300
    Processing by Doorkeeper::AuthorizationsController#create as <em>/</em>
      Parameters: {"response_type"=>"6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440", "client_id"=>"9c291dc4aa87bfafd6c6a4cf6930d225c106f8fe88e1d0769832047f1ee011c4", "client_secret"=>"[FILTERED]", "redirect_uri"=>"urn:ietf:wg:oauth:2.0:oob", "username"=>"foo@bar.com"}
    Can't verify CSRF token authenticity
    Completed 422 Unprocessable Entity in 1ms
    ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken): 
    ...</p>
  </blockquote>
  
  <p>What, am I doing wrong?</p>