we can't trust CSRF for anon the way it is designed.

The page they have loaded may be cached we need a different way of delivering the CSRF potentially

app/controllers/users_controller.rb

@@ -8,6 +8,11 @@ class UsersController < ApplicationController
 
   before_filter :ensure_logged_in, only: [:username, :update, :change_email, :user_preferences_redirect]
 
+  # we need to allow account creation with bad CSRF tokens, if people are caching, the CSRF token on the 
+  #  page is going to be empty, this means that server will see an invalid CSRF and blow the session
+  #  once that happens you can't log in with social
+  skip_before_filter :verify_authenticity_token, only: [:create]
+
   def show
     @user = fetch_user_from_params
     user_serializer = UserSerializer.new(@user, scope: guardian, root: 'user')