Merge pull request #1767 from okriuchykhin/ok_SCI_2841

Improve handling of CSRF token errors [SCI-2841]

app/controllers/application_controller.rb

@@ -10,6 +10,10 @@ class ApplicationController < ActionController::Base
   around_action :set_time_zone, if: :current_user
   layout 'main'
 
+  rescue_from ActionController::InvalidAuthenticityToken do
+    redirect_to root_path
+  end
+
   def respond_422(message = t('client_api.permission_error'))
     respond_to do |format|
       format.json do

app/controllers/users/sessions_controller.rb

@@ -1,6 +1,11 @@
 class Users::SessionsController < Devise::SessionsController
   # before_filter :configure_sign_in_params, only: [:create]
   after_action :after_sign_in, only: :create
+
+  rescue_from ActionController::InvalidAuthenticityToken do
+    redirect_to new_user_session_path
+  end
+
   # GET /resource/sign_in
   def new
     # If user was redirected here from OAuth's authorize/new page (Doorkeeper