I am facing the same problem. Here is how I decided:
response.set_cookie "name", "nic"
I also came up with the cause of the problem. This is a fake protection that ends the session just before a response is generated.
To use cookies , you need to skip token authentication:
skip_before_action :verify_authenticity_token
source share