change
protect_from_forgery with: :exception
to
protect_from_forgery with: :null_session
in ApplicationController