Put authentication on api

app/controllers/application_controller.rb

@@ -1,12 +1,16 @@
 class ApplicationController < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
-  protect_from_forgery with: :null_session
+  protect_from_forgery with: :exception
 
   rescue_from CanCan::AccessDenied do |exception|
     redirect_to root_url, alert: exception.message
   end
 
+  def authenticate_user_or_client!
+    current_user || current_client || raise(Exception.new)
+  end
+
   def current_client
     @current_client ||= identify_client
   end
@@ -15,7 +19,7 @@ class ApplicationController < ActionController::Base
     if current_user
       @current_ability ||= Ability.new(current_user)
     elsif current_client
-      @current_ability ||= ClientAbility.new(current_account)
+      @current_ability ||= ClientAbility.new(current_client)
     end
   end
 
@@ -25,5 +29,4 @@ class ApplicationController < ActionController::Base
     key = request.headers["X-API-KEY"]
     Client.find_by key: key if key
   end
-
 end

app/controllers/transactions_controller.rb

@@ -1,4 +1,9 @@
 class TransactionsController < ApplicationController
+  skip_before_filter :verify_authenticity_token, only: :create
+
+  before_action :authenticate_user!, except: :create
+  before_action :authenticate_user_or_client!, only: :create
+
   def index
     @transactions = Transaction.all
   end