developer strategy: ActionController::InvalidAuthenticityToken in SessionsController#create

[bingUSE]

Please complete all sections.

Configuration

• Provider Gem: omniauth* #.lock shows omniauth (1.9.0)
• Ruby Version: 2.4.0
• Framework: 'rails', '4.2.10'
• Platform: ubuntu #on cloud 9 ide

Expected Behavior

Using develper strategy, callback should be provided with valid token

Actual Behavior

Goes to auth/developer login form correctly, but then raises following error instead of returning to auth/developer/callback which routes to sessions#create:
ActionController::InvalidAuthenticityToken in SessionsController#create
ActionController::InvalidAuthenticityToken

Steps to Reproduce

Register or Log In with Developer
Click on above link which is on login page.

Register or Log In with GitHub
Register or Log In with Facebook
Other links work normally, also passes Cucumber tests in test mode.
Only problem is that I need to do an end run on actual authentication while I'm in develper mode so actual providers aren't abused.

Let me know which files I should include.

[rosewcs345]

I found this in another section of the Wiki:
Rails session is clobbered after callback on Developer strategy
The developer strategy callback is sent using POST request. Disable forgery protection for given action, otherwise session will be clobbered by rails.

skip_before_action :verify_authenticity_token, only: :create

Is this before_action being handled by omniauth itself, or should I add it to my controllers when NOT in developer mode?
It looks as though this scheme works by just adding that line in developer mode, and deleting it in production, which seems pretty unreliable. Is there a way to enforce it automatically instead?