title: CSRF mismatch when POSTing to sails backend from Angular JS
body: <p>In angular, I obtain a CSRF token like this:</p>
  
  <pre><code>// Get CSRF token and set as header
  var csrfRequest = Auth.getCSRF().then(function(data){
      console.log(data.data._csrf);
      $rootScope.csrf = data.data._csrf;
  });
  </code></pre>
  
  <p>Which logs the new token to the console (this works fine). </p>
  
  <p>Then, I try to login to a sails.js api. Here's the request:</p>
  
  <pre><code>POST /auth/login HTTP/1.1
  Host: localhost:1337
  Connection: keep-alive
  Content-Length: 108
  Pragma: no-cache
  Cache-Control: no-cache
  Accept: application/json, text/plain, */*
  Origin: http://localhost
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
  Content-Type: application/json;charset=UTF-8
  Referer: http://localhost/sails-front/src/login/
  Accept-Encoding: gzip, deflate
  Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
  
  Request Payloadview parsed
      {"email":"myemail@email.com","password":"mypass","_csrf":"PIlVO7S362OroPGBSG0X1vW2FydkP9VhK8cMk="}
  </code></pre>
  
  <p>The <code>_csrf</code> field is the same as that which was received in the <code>getCSRF</code> call.</p>
  
  <p>Yet I get the response 'CSRF mismatch'. However, when I try the exact same thing with Postman, it works fine (so I don't think it's a problem with the sails server).</p>
  
  <p>Here's the login code in angular. In the controller:</p>
  
  <pre><code>$scope.login = function() {
      Auth.login({
              email: $scope.email,
              password: $scope.password,
              _csrf: $rootScope.csrf
          },
          function(res) {
              $state.go('app.home');
          },
          function(err) {
              $rootScope.error = "Failed to login";
          });
  };
  </code></pre>
  
  <p>And the <code>Auth</code> service:</p>
  
  <pre><code>/*********************************
  * login
  ******************************** */
  function login(user, success, error) {
      $http.post(API_BASE_URL + 'auth/login', user).success(function(user){
          changeUser(user);
          success(user);
      }).error(error);
  }
  </code></pre>