Why is my user not signed in when returning from a Paypal payment?

After a user has signed up for an account, they are automatically signed in.

Then they have the option of "Activating their account" to unlock the app's features. The account activation leads them to a Paypal gateway. After successfully completing payment they are redirected back to an invoice page. However there is no current user session on the invoice page. Any ideas on what I'm doing wrong? the code is below

I'm using devise to manage authentication.

Here's the User Model

    class User < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

  validates :first_name, :last_name, :email, :password, presence: true

  serialize :notification_params, Hash
  def paypal_url(return_path)
    values = {
        business: "seller@seller.com",
        cmd: "_xclick",
        upload: 1,
        return: "#{Rails.application.secrets.app_host}#{return_path}",
        invoice: id,
        amount: 20,
        item_name: "Online Store",
        item_number: 1,
        quantity: '1',
        notify_url: "#{Rails.application.secrets.app_host}/hook"
    }
    "#{Rails.application.secrets.paypal_host}/cgi-bin/webscr?" + values.to_query
  end

end

Here are my routes:

Rails.application.routes.draw do
  devise_for :users #, :controllers => {:registrations => 'memberships'}
  root 'pages#dashboard'
  get 'home' => 'pages#dashboard'

  devise_scope :user do 
    post 'invoice' => "memberships#show"
    post 'hook' => "memberships#hook"
  end

Here's the controller managing the payment/webhook

class MembershipsController < ApplicationController

  def show
    @user = current_user

  end

  protect_from_forgery except: [:hook]
  def hook
    params.permit! # Permit all Paypal input params
    status = params[:payment_status]
    if status == "Completed"
      @user = User.find params[:invoice]
      @user.update_attributes notification_params: params, status: status, transaction_id: params[:txn_id], purchased_at: Time.now
    end
    render nothing: true
  end
end