Rails dropzone how to fix 400 Bad Request?

here's the scenario: after setup the dropzone js, the controller and the routes the dropzone shows 400 Bad Request after upload a file. I added authenticity_token= data-post-url since any ajax request in rails get a error if not include it.

so i would like to know what i missing here.

dropzone js

  $(document).ready(function () {
   Dropzone.autoDiscover = false;
    $('#file').dropzone({// PDF dropzone element
        maxFilesize: 2, // Set the maximum file size to 256 MB
        maxFiles: 10,
        dictDefaultMessage: "drop the files",
        paramName: "proofs[file]",
        addRemoveLinks: true, // Don't show remove links on dropzone itself.
        dictRemoveFile: 'Remover',
        uploadMultiple: true,
       method: 'post',
       acceptedFiles: "image/*",
        url: $('#file').data('post-url')



    });
});


dispute show view

 <div class="dropzone" id="file" data-post-url="<%=  upload_order_dispute_path + '?authenticity_token=' + form_authenticity_token %>"></div>



dispute controller

 def upload
    @dispute = @order.dispute
    respond_to do |format|
      format.json do
        if @dispute.update_attributes(params[:dispute])
          params[:proofs]['file'].each do |a|
            @proof = @dispute.proofs.create!(:file => a)
          end
        end
        render :nothing => true
      end

    end
  end


 routes
 resource :dispute do
post 'upload'=>'dispute#upload'
end