created cors for "options" and changed CSRF token preferences

app/controllers/application_controller.rb

@@ -1,9 +1,40 @@
 class ApplicationController < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
-  protect_from_forgery with: :exception
+  #protect_from_forgery with: :exception
+  protect_from_forgery with: :null_session
   before_action :set_access_headers
 
+before_filter :cors_preflight_check
+
+
+# For all responses in this controller, return the CORS access control headers.
+
+def cors_set_access_control_headers
+ headers['Access-Control-Allow-Origin'] = '*'
+ headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
+ headers['Access-Control-Allow-Headers'] = '*,x-requested-with,Content-Type,If-Modified-Since,If-None-Match,Auth-User-Token'
+ headers['Access-Control-Max-Age'] = "86400"
+end
+
+# If this is a preflight OPTIONS request, then short-circuit the
+# request, return only the necessary headers and return an empty
+# text/plain.
+
+def cors_preflight_check
+ if request.method == :options
+ headers['Access-Control-Allow-Origin'] = '*'
+ headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
+ # headers['Access-Control-Allow-Headers'] = 'X-Requested-With, X-Prototype-Version'
+ headers['Access-Control-Allow-Headers'] = '*,x-requested-with,Content-Type,If-Modified-Since,If-None-Match,Auth-User-Token'
+ headers['Access-Control-Max-Age'] = '86400'
+ headers['Access-Control-Allow-Credentials'] = 'true'
+ render :text => '', :content_type => 'text/plain'
+end
+end 
+
+
+
   ##
   # Error pages show_403 show_404 etc...
   [404, 500].each do |num|

app/views/application/cors_preflight_check.json

@@ -0,0 +1,6 @@
+{
+ "status":{
+ "code": 200,
+ "msg": ""
+ }
+}

config/routes.rb

@@ -1,9 +1,11 @@
 Imagenary::Application.routes.draw do
   root 'photos#index'
 
+ match '*all' => 'application#cors_preflight_check', via: [:options]
+
   resources :about, only: [:index] do
     get :api, on: :collection
-  end
+  end 
 
   resources :users, only: [:index, :create, :destroy] do
     collection do