More "found unpermitted parameter: confirm_success_url" ... Troubles

Nobody has claimed this yet.

I have reached the point where I need some help/suggestions. Any help would be greatly appreciated.

Summary -

I have installed and configured devise_token_auth according to what I understand is the correct process and have confirmed this setup as far as I can via the "help me" and google search.. I am trying to create a User with the expectation that I will receive a confirmation link email.
1. If I include the parameter "confirm_success_url"-
using this -

```
curl -XPOST http://localhost:7000/api/v1/auth --data "email=mail@mail.com&password=123456789&password_confirmation=12345678&confirm_success_url=http://localhost:7000/" -o results.html
```

I receive this -

```
ActionController::UnpermittedParameters in DeviseTokenAuth::RegistrationsController#create
found unpermitted parameter: confirm_success_url ... (much more stuff)
```
1. If I don't include the "confirm_success_url"
using this -

```
curl -XPOST http://localhost:7000/api/v1/auth --data "email=mail@mail.com&password=123456789&password_confirmation=123456789" -o results.html
```

I receive this -

```
{"status":"error","data":{"id":null,"provider":"email","uid":"","name":null,"nickname":null,"image":null,"email":"mail@mail.com","created_at":null,"updated_at":null},"errors":["Missing `confirm_success_url` param."]}
```

I have tried many variations of the curl command with no change in results.

It would seem that there might be an issue with the CSRF Token Authenticity (see log below) but I have everything set according to how I understand (:null_session) to avoid that issue

Anyone have any thoughts??

Details -

``` ruby
routing.rb -
Iosrails::Application.routes.draw do
namespace :api do
scope module: :v1, constraints: ApiConstraints.new(version: 1, default: true) do
mount_devise_token_auth_for 'User', at: 'auth'
end
end
end
```

``` ruby
application_controller.rb -
class ApplicationController < ActionController::Base
include DeviseTokenAuth::Concerns::SetUserByToken
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
#protect_from_forgery with: :exception
protect_from_forgery with: :null_session
end
```

``` ruby
user.rb -
class User < ActiveRecord::Base
# Include default devise modules.
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable,
:confirmable, :omniauthable
include DeviseTokenAuth::Concerns::User
end
```

``` ruby
development.log -
Started POST "/api/auth" for 127.0.0.1 at 2015-05-12 14:38:54 -0400
Processing by DeviseTokenAuth::RegistrationsController#create as */*
Parameters: {"email"=>"mail@mail.com", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]", "confirm_success_url"=>"http://localhost:7000/"}
Can't verify CSRF token authenticity
Completed 500 Internal Server Error in 2ms (ActiveRecord: 0.0ms)
** [Airbrake] Notice was not sent due to configuration:
Environment Monitored? false
API key set? false

ActionController::UnpermittedParameters (found unpermitted parameter: confirm_success_url):
{ and much more}
```

Start with DeviseTokenAuth::RegistrationsController#create and reproduce the request using the curl commands in the issue. Review routing.rb, application_controller.rb, and user.rb alongside the development.log output; done means registration accepts confirm_success_url and reaches the expected confirmation-email flow without the unpermitted-parameter error.

Written by the indexing model from the issue text.