Sign in via phone number doesn't seem to work correctly

Then I change the form to pass "telephone" and "password" to the server and I get Status 403 Forbidden.

Processing by DeviseTokenAuth::RegistrationsController#create as JSON
  Parameters: {"telephone"=>"1234567899", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]", "confirm_success_url"=>"http://localhost:3000/"}
Unpermitted parameters: confirm_success_url, format
Unpermitted parameters: confirm_success_url, format
Unpermitted parameters: confirm_success_url, format
   (0.1ms)  begin transaction
   (0.3ms)  SELECT COUNT(*) FROM "users" WHERE "users"."provider" = ? AND "users"."email" IS NULL  [["provider", "email"]]
   (0.1ms)  rollback transaction
Completed 403 Forbidden in 170ms (Views: 0.6ms | ActiveRecord: 1.1ms)

i have follow this how to ==> https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-sign-in-with-something-other-than-their-email-address

The JSON response is:

"errors":{"email":["can't be blank","is not an email"],"full_messages":["Email can't be blank","Email is not an email"]}

My user.rb:

class User < ActiveRecord::Base

  devise :database_authenticatable, :registerable,
    :recoverable, :rememberable, :trackable, :validatable,
    :confirmable, :omniauthable, :authentication_keys => [:telephone]

  include DeviseTokenAuth::Concerns::User

  def email_required?
    false
  end

  def email_changed?
    false
  end
end

My application_controller:

class ApplicationController < ActionController::API
  include DeviseTokenAuth::Concerns::SetUserByToken
  respond_to :json
  before_action :ensure_json_request  
  before_action :configure_permitted_parameters, if: :devise_controller?

  def ensure_json_request  
    return if request.format == :json
    render :nothing => true, :status => 406  
  end

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_in)        << :telephone
    devise_parameter_sanitizer.for(:sign_up)        << :telephone
    devise_parameter_sanitizer.for(:account_update) << :telephone
  end
end

Start with the User model and ApplicationController configuration shown in the report, then trace DeviseTokenAuth::RegistrationsController#create using the logged telephone sign-up request. Reproduce the 403 response and inspect why email validation remains active despite the telephone authentication key. Done means the intended telephone-based authentication flow completes without the reported email validation errors.