class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
  before_filter :vary_by_accept

  private

  # This adds a Vary for responses. This is useful when returning a URL that
  # has multiple representations depending on the Accepts header sent by the
  # client.
  def vary_by_accept
    response.headers['Vary'] = 'Accept'
  end
end

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
end

--- 
+++ 
@@ -2,4 +2,14 @@
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
+  before_filter :vary_by_accept
+
+  private
+
+  # This adds a Vary for responses. This is useful when returning a URL that
+  # has multiple representations depending on the Accepts header sent by the
+  # client.
+  def vary_by_accept
+    response.headers['Vary'] = 'Accept'
+  end
 end
Add Vary header for multiple representations
