I'm running into a CSRF issue using Auth in an SPA. If a user logs in, then logs out, and then tries to log back in, the CSRF token needs to be renewed from the server. Typically Rails does this for you automatically in a page refresh, but since I have an SPA, I need to do this manually. Per https://stackoverflow.com/questions/11845500/rails-devise-authentication-csrf-issue# I was hoping to have my logout (DELETE) endpoint return the new CSRF token and store it in the HTML, but the promise of Auth.logout only gives me the old user object and doesn't give me visibility to the server's response from the DELETE.