rails 4 omniauth developer strategy - error on callback - ActionController::InvalidAuthenticityToken in SessionsController#create - ruby-on-rails-4

Question

c9 ide, Ubuntu workspace, rails 4.2.10, ruby 2.4.0
When trying to use omniauth gem in developer mode with developer strategy, login link to 'auth/developer' successfully presents form to user. Upon form submission (where route is 'auth/developer/callback') this error is generated:
ActionController::InvalidAuthenticityToken in SessionsController#create
Would like to be able to use developer strategy during the remainder of application development. Documentation doesn't seem to specify anything else needed for the callback when using the developer strategy (in development mode). There does seem to be at least one small discrepancy in the doc, is something missing as well??
All code working properly when using actual providers or during test mode with cucumber.
Here is portion of initializer code (not including keys/secrets) which I started with in config/initializers/omniauth.rb:
OmniAuth.config.logger = Rails.logger
Rails.application.config.middleware.use OmniAuth::Builder do
provider :developer unless Rails.env.production?
provider :github, 'redacted,'redacted',
{ :name => "github", :scope => ['read:user','user:email']}
provider :facebook, 'redacted', 'redacted'
end
Gemfile includes:
gem 'omniauth'
gem 'omniauth-github'
gem 'omniauth-facebook'
routes.rb:
match 'auth/:provider/callback', :to => 'sessions#create', :via => [:get, :post]
sessions_controller:
def create
begin
authenticator = Authentication.new(env["omniauth.auth"])
authenticator.disallow(session[:user_id]) if session?
authenticator.deny if authenticator.missing_information?
auth, message = authenticator.register_or_login
session[:user_id] = auth.user.id
etc.
app/controllers/sessions_controller/authentication.rb:
def initialize(omniauth)
# get Omniauth authentication hash
#auth_hash = omniauth
end
def auth_hash
#auth_hash
end
etc.
When successful (using other providers or in test mode), callback should be provided with valid token, path of code can then easily be traced through create method of sessions_controller to the constructor of the Authenticator class, etc.
When in development mode using developer strategy, the body of the sessions create method is never entered at all.
After getting valid token, I should see messages such as:
"Welcome <name> You've signed up via <provider>."
However, since error is raised before that point, only see the following in the server output:
Processing by SessionsController#create as HTML
Parameters: {"name"=>"Example User", "email"=>"example#user.com", "provider"=>"developer"}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)
ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
actionpack (4.2.10) lib/action_controller/metal/request_forgery_protection.rb:181:in `handle_unverified_request'

Answer 1

I found this in another section of the Wiki:
Rails session is clobbered after callback on Developer strategy
The developer strategy callback is sent using POST request. Disable forgery protection for given action, otherwise session will be clobbered by rails.
skip_before_action :verify_authenticity_token, only: :create
This definitely works, but I still have a few questions.
Is the before_action defined and handled by omniauth itself, or should I add it to my controllers when NOT in developer mode?
It looks as though this scheme works by just adding that line in developer mode, and deleting it in production, which seems pretty unreliable. Is there a way to enforce it automatically instead?