ruby on rails 4 - Doorkeeper::AuthorizationsController#create Can't verify CSRF token authenticity -

i followed page https://github.com/doorkeeper-gem/doorkeeper/wiki/using-resource-owner-password-credentials-flow testing api

curl -f grant_type=password \ -f username=foo@bar.com \ -f password=mypass \ -x post http://localhost:3000/oauth/token 

and got response:

{"access_token":"6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440","token_type":"bearer","expires_in":600,"refresh_token":"c1445d0a27a8278268c1187c2e3da7163525f1fac8093890430edd328f51c3de","created_at":1429931390}

but when call /oauth/authorize with:

curl -f response_type=6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440 \ -f client_id=9c291dc4aa87bfafd6c6a4cf6930d225c106f8fe88e1d0769832047f1ee011c4 \ -f client_secret=decba5aca425095978d33653ef03d654f0b74427bcec0596bdde518016708c35 \ -f redirect_uri=urn:ietf:wg:oauth:2.0:oob \ -f username=foo@bar.com \ -x post http://localhost:3000/oauth/authorize

but got:

started post "/oauth/authorize" 127.0.0.1 @ 2015-04-25 00:30:05 -0300 processing doorkeeper::authorizationscontroller#create / parameters: {"response_type"=>"6d4398b75d94835631a453af770161a6f58618b101b58ccf62a5a8492bce3440", "client_id"=>"9c291dc4aa87bfafd6c6a4cf6930d225c106f8fe88e1d0769832047f1ee011c4", "client_secret"=>"[filtered]", "redirect_uri"=>"urn:ietf:wg:oauth:2.0:oob", "username"=>"foo@bar.com"} can't verify csrf token authenticity completed 422 unprocessable entity in 1ms actioncontroller::invalidauthenticitytoken (actioncontroller::invalidauthenticitytoken): ...

what, doing wrong?

if you're working on api only, guess can turned off in environment file (test/developpement/production.rb) adding line :

config.action_controller.allow_forgery_protection = false'

cheers !