CSRF detected error after using omniauth authorization on android device

Nobody has claimed this yet.

I use devise_token_auth + omniauth authorization + gem google_oauth2. So it's work well in web app. But in mobile I have some problems with it. When the android app post the authorization code to /omniauth/google_oauth2/callback I always get the error:

INFO -- : [5fe94566-e098-4a4a-b274-ca24606beb27] Started POST "myapp/omniauth/google_oauth2/callback" for 91.102.176.32 at 2018-03-07 13:22:44 +0000
INFO -- omniauth: (google_oauth2) Callback phase initiated.
**ERROR -- omniauth: (google_oauth2) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected**
INFO -- : [5fe94566-e098-4a4a-b274-ca24606beb27] Processing by Devise::OmniauthCallbacksController#failure as HTML
INFO -- : [5fe94566-e098-4a4a-b274-ca24606beb27] Parameters: {"code"=>"4/AACauqwi5alzAwsWvoSbNnsKSQ63HNDMhX0jXoGbcDCPyoVObPUekAyHLh1wcA4RkZjjsz_NWG2sFCHDGl9kchQ"}
INFO -- : [5fe94566-e098-4a4a-b274-ca24606beb27] Redirected to https://myapp/auth/sign_in
INFO -- : [5fe94566-e098-4a4a-b274-ca24606beb27] Completed 302 Found in 1ms (ActiveRecord: 0.0ms)
INFO -- : [a08dd2a1-5565-433d-b20d-959ac2a4a469] Started GET "/auth/sign_in" for 91.102.176.32 at 2018-03-07 13:22:44 +0000
INFO -- : [a08dd2a1-5565-433d-b20d-959ac2a4a469] Processing by DeviseTokenAuth::SessionsController#new as HTML
INFO -- : [a08dd2a1-5565-433d-b20d-959ac2a4a469] Completed 405 Method Not Allowed in 1ms (Views: 0.2ms | ActiveRecord: 0.0ms)

Start by tracing the POST /omniauth/google_oauth2/callback entry point through Devise::OmniauthCallbacksController#failure and the logged CSRF validation failure. Reproduce the Android authorization-code flow and verify that a valid request no longer redirects to /auth/sign_in with a CSRF detected error.

Written by the indexing model from the issue text.