Skip CSRF token for OmniAuth callbacks (prevents session reset)

OmniAuth callbacks need to accept a raw POST from the auth provider without
verifying the CSRF token, otherwise the session will be reset.

See intridea/omniauth#203
See also http://www.communityguides.eu/articles/16

(This technique will also be needed for API endpoints when the time comes)

app/controllers/services_controller.rb

@@ -3,6 +3,11 @@
 #   the COPYRIGHT file.
 
 class ServicesController < ApplicationController
+  # We need to take a raw POST from an omniauth provider with no authenticity token.
+  # See https://github.com/intridea/omniauth/issues/203
+  # See also http://www.communityguides.eu/articles/16
+  skip_before_filter :verify_authenticity_token, :only => :create
+
   before_filter :authenticate_user!
 
   respond_to :html