app.coffee

# Set up the application
app = angular.module('ratingRampage', [])

# This is an injectable property
app.value 'Authentication', {}

# Add a directive so that if we see a csrf-token attribute, this gets set
app.directive 'csrfToken', (Authentication) ->
  (scope, element, attrs) ->
    Authentication.csrf_token = attrs.csrfToken

# Some service, which needs to make a POST request
app.factory 'Rating', ($http, Authentication) ->
  class Rating
    constructor: (@film) ->
      
    save: (rating) ->
      # Add the authenticity_token as a POST param
      $http.post(@film.rating_url,
        authenticity_token: Authentication.csrf_token,
        rating: rating
      ).success => @saved()
    
    saved: -> #...

app.erb

<div ng-app="ratingRampage' csrf-token="<%= form_authenticity_token %>">
  <!-- Your app code goes here -->
</div>