Thanks you make amazing Gem. and all contributers. I think add httponly: true in template of devise.rb. A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it's ...