ruby on rails - Can't send token with request with ng-token-auth/devise-token-auth -

i'm working through great tutorial can found here: https://www.airpair.com/ruby-on-rails/posts/authentication-with-angularjs-and-ruby-on-rails written https://stackoverflow.com/users/199712/jason-swett.

i'm trying figure out why can't send request token in header on sign_in. user registration call works great , new user gets created in db, when try log in, no token sent.

here's index.coffee

angular.module 'angdomino', ['nganimate', 'ngcookies', 'ngtouch', 'ngsanitize', 'ngresource', 'ui.router', 'rails', 'ng-token-auth']   .config ($stateprovider, $urlrouterprovider, $locationprovider, $authprovider) ->     $authprovider.configure({       apiurl: '/api'       })     $locationprovider.html5mode({       enabled: true,       requirebase: false       })     $stateprovider       .state "home",         url: "/",         templateurl: "app/views/main.html",         controller: "mainctrl"       .state "groups",         url: "/groups",         templateurl: "app/views/groups.html",         controller: "groupsctrl"       .state "sign_in",         url: "/sign_in",         templateurl: "app/views/user_sessions/new.html",         controller: "usersessionsctrl"       .state "sign_up",         url: "/sign_up",         templateurl: "app/views/user_registrations/new.html",         controller: "userregistrationsctrl"      $urlrouterprovider.otherwise '/'    .factory "group", (railsresource) ->     class group extends railsresource       @configure url: "/api/groups", name: "group" 

here's registration request header:

accept:application/json, text/plain, */* accept-encoding:gzip, deflate accept-language:en-us,en;q=0.8 cache-control:max-age=0 connection:keep-alive content-length:158 content-type:application/json;charset=utf-8 dnt:1 host:localhost:9000 if-modified-since:0 origin:http://localhost:9000 referer:http://localhost:9000/sign_up 

and registration response:

access-token:zac77ktvm_bbxexmif5okg cache-control:max-age=0, private, must-revalidate client:aqyopncbiiufwazqtkipzg connection:close content-length:240 content-type:application/json; charset=utf-8 date:tue, 28 apr 2015 23:38:58 gmt etag:"e190da3eab4b3b2da0d6dc8257fd6d91" expiry:1431473938 server:webrick/1.3.1 (ruby/2.1.2/2014-05-08) token-type:bearer uid:cc0e37ab-f891-4334-a887-c0a71903edf9 x-content-type-options:nosniff x-frame-options:sameorigin x-request-id:8bf9fe8a-73b9-4e3d-ad40-c8574e88e7c3 x-runtime:0.272364 x-xss-protection:1; mode=block 

the sign out works (req header):

accept:application/json, text/plain, */* accept-encoding:gzip, deflate, sdch accept-language:en-us,en;q=0.8 access-token:0psupg02kwsbu6k1nqutxq cache-control:max-age=0 client:aqyopncbiiufwazqtkipzg connection:keep-alive cookie:auth_headers=%7b%22access-token%22%3a%220psupg02kwsbu6k1nqutxq%22%2c%22token-type%22%3a%22bearer%22%2c%22client%22%3a%22aqyopncbiiufwazqtkipzg%22%2c%22expiry%22%3a%221431474351%22%2c%22uid%22%3a%22d1871d3d-a8a9-437a-88b9-e0a43f5896da%22%7d dnt:1 expiry:1431474351 host:localhost:9000 if-modified-since:0 origin:http://localhost:9000 referer:http://localhost:9000/sign_up token-type:bearer uid:d1871d3d-a8a9-437a-88b9-e0a43f5896da 

but when try login same email/pwd, get:

general

remote address:127.0.0.1:9000 request url:http://localhost:9000/api/auth/sign_in request method:post status code:401 unauthorized 

request headers

accept:application/json, text/plain, */* accept-encoding:gzip, deflate accept-language:en-us,en;q=0.8 cache-control:max-age=0 connection:keep-alive content-length:43 content-type:application/json;charset=utf-8 dnt:1 host:localhost:9000 if-modified-since:0 origin:http://localhost:9000 referer:http://localhost:9000/sign_in 

does know why login won't send token? here's user_sessions controller (in coffeescript):

angular.module('angdomino').controller 'usersessionsctrl', [   '$scope'   ($scope) ->     $scope.$on 'auth:login-error', (ev, reason) ->       $scope.error = reason.errors[0]       return     return ] 

here complete sign_in headers:

general remote address:127.0.0.1:9000 request url:http://localhost:9000/api/auth/sign_in request method:post status code:401 unauthorized  response headers view source cache-control:no-cache connection:close content-length:59 content-type:application/json; charset=utf-8 date:thu, 07 may 2015 12:53:46 gmt server:webrick/1.3.1 (ruby/2.1.2/2014-05-08) x-content-type-options:nosniff x-frame-options:sameorigin x-request-id:480b63c1-1415-4c49-8774-ccfc11eee644 x-runtime:0.005285 x-xss-protection:1; mode=block  request headers view source accept:application/json, text/plain, */* accept-encoding:gzip, deflate accept-language:en-us,en;q=0.8 cache-control:max-age=0 connection:keep-alive content-length:43 content-type:application/json;charset=utf-8 dnt:1 host:localhost:9000 if-modified-since:0 origin:http://localhost:9000 referer:http://localhost:9000/sign_in user-agent:mozilla/5.0 (macintosh; intel mac os x 10_10_3) applewebkit/537.36 (khtml, gecko) chrome/42.0.2311.135 safari/537.36  request payload     view source     {email: "b@b.com", password: "1234567890"}     email: "b@b.com"     password: "1234567890" 

here's dev.log sign_up:

started post "/api/auth" 127.0.0.1 @ 2015-05-07 07:40:18 -0500   [1m[36mactiverecord::schemamigration load (0.9ms)[0m  [1mselect "schema_migrations".* "schema_migrations"[0m processing devisetokenauth::registrationscontroller#create html   parameters: {"email"=>"b@b.com", "password"=>"[filtered]", "password_confirmation"=>"[filtered]", "confirm_success_url"=>"http://localhost:9000/sign_up", "config_name"=>"default"} unpermitted parameters: confirm_success_url, config_name unpermitted parameters: confirm_success_url, config_name   [1m[35m (0.4ms)[0m  begin   [1m[36m (1.4ms)[0m  [1mselect count(*) "users"  "users"."provider" = 'email' , "users"."email" = 'b@b.com'[0m   [1m[35msql (2.9ms)[0m  insert "users" ("confirmed_at", "created_at", "email", "encrypted_password", "provider", "tokens", "uid", "updated_at") values ($1, $2, $3, $4, $5, $6, $7, $8) returning "id"  [["confirmed_at", "2015-05-07 12:40:18.475118"], ["created_at", "2015-05-07 12:40:18.475466"], ["email", "b@b.com"], ["encrypted_password", "$2a$10$7dsknalwmhcutrwsdeblsen85tza9deyh.q.enxhllwzenodvbumy"], ["provider", "email"], ["tokens", "{}"], ["uid", "b@b.com"], ["updated_at", "2015-05-07 12:40:18.475466"]]   [1m[36m (79.9ms)[0m  [1mcommit[0m   [1m[35m (0.1ms)[0m  begin   [1m[36msql (0.5ms)[0m  [1mupdate "users" set "confirmed_at" = $1, "tokens" = $2, "uid" = $3, "updated_at" = $4 "users"."id" = 2[0m  [["confirmed_at", "2015-05-07 12:40:18.638115"], ["tokens", "{\"wassqpp_tjvak-voroxwhg\":{\"token\":\"$2a$10$ajfjmimoqnqfz3t9ritgwozhmrwtuencbhzdvcc2b0gbsinkgihuc\",\"expiry\":1432212018}}"], ["uid", "9ae44b7b-3f7a-4f2d-9091-4cc779751355"], ["updated_at", "2015-05-07 12:40:18.638237"]]   [1m[35m (0.3ms)[0m  commit   [1m[36m (0.1ms)[0m  [1mbegin[0m   [1m[35muser load (0.5ms)[0m  select  "users".* "users"  "users"."id" = $1 limit 1 update  [["id", 2]]   [1m[36msql (0.6ms)[0m  [1mupdate "users" set "confirmed_at" = $1, "tokens" = $2, "uid" = $3, "updated_at" = $4 "users"."id" = 2[0m  [["confirmed_at", "2015-05-07 12:40:18.712254"], ["tokens", "{\"wassqpp_tjvak-voroxwhg\":{\"token\":\"$2a$10$nb1iyrmzngjvi34tmk5ysers4ioulvvimjsa5q8uop5aruxmotxda\",\"expiry\":1432212018,\"last_token\":\"$2a$10$ajfjmimoqnqfz3t9ritgwozhmrwtuencbhzdvcc2b0gbsinkgihuc\",\"updated_at\":\"2015-05-07t07:40:18.711-05:00\"}}"], ["uid", "95b1c932-b763-4f32-b441-0968175575d5"], ["updated_at", "2015-05-07 12:40:18.712496"]]   [1m[35m (0.3ms)[0m  commit completed 200 ok in 363ms (views: 0.3ms | activerecord: 90.3ms)   started "/api/auth/validate_token" 127.0.0.1 @ 2015-05-07 07:44:29 -0500 processing devisetokenauth::tokenvalidationscontroller#validate_token html   [1m[36muser load (0.5ms)[0m  [1mselect  "users".* "users"  "users"."uid" = '95b1c932-b763-4f32-b441-0968175575d5' limit 1[0m   [1m[35m (0.3ms)[0m  begin   [1m[36muser load (0.5ms)[0m  [1mselect  "users".* "users"  "users"."id" = $1 limit 1 update[0m  [["id", 2]]   [1m[35msql (1.0ms)[0m  update "users" set "confirmed_at" = $1, "tokens" = $2, "uid" = $3, "updated_at" = $4 "users"."id" = 2  [["confirmed_at", "2015-05-07 12:44:29.561416"], ["tokens", "{\"wassqpp_tjvak-voroxwhg\":{\"token\":\"$2a$10$7zzrrlj3rvis0h/jquitb.4keqfdendb92ucdf84exsf93v5ezifs\",\"expiry\":1432212269,\"last_token\":\"$2a$10$nb1iyrmzngjvi34tmk5ysers4ioulvvimjsa5q8uop5aruxmotxda\",\"updated_at\":\"2015-05-07t07:44:29.560-05:00\"}}"], ["uid", "c9719276-a107-41f7-868f-9ed8c87cfa3a"], ["updated_at", "2015-05-07 12:44:29.561612"]]   [1m[36m (1.2ms)[0m  [1mcommit[0m completed 200 ok in 144ms (views: 0.2ms | activerecord: 3.4ms) 

and here dev.log sign_in:

started post "/api/auth/sign_in" 127.0.0.1 @ 2015-05-07 07:53:46 -0500 processing devisetokenauth::sessionscontroller#create html   parameters: {"email"=>"b@b.com", "password"=>"[filtered]"}   [1m[35muser load (1.5ms)[0m  select  "users".* "users"  (uid='b@b.com' , provider='email')  order "users"."id" asc limit 1 completed 401 unauthorized in 3ms (views: 0.2ms | activerecord: 1.5ms) 

apparently, @ least @ point in time, have make user's uid match user's email.