Release v3.5.5

Do not timeout if remember me is enabled
Readd remember_expired?
2026-01-11 08:37:56 -05:00 · 2016-01-22 20:22:34 +01:00 · 2016-01-22 16:18:57 +01:00 · 2016-01-22 15:57:57 +01:00 · 2016-01-18 15:12:07 +01:00 · 2016-01-18 14:47:31 +01:00
246 changed files with 3533 additions and 5517 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,89 +1,44 @@
 language: ruby

 rvm:
-  - 2.1.10
-  - 2.2.10
-  - 2.3.8
-  - 2.4.5
-  - 2.5.3
-  - 2.6.0
-  - ruby-head
+  - 1.9.3
+  - 2.0.0
+  - 2.1
+  - 2.2

 gemfile:
-  - Gemfile
-  - gemfiles/Gemfile.rails-6.0-stable
-  - gemfiles/Gemfile.rails-5.2-stable
-  - gemfiles/Gemfile.rails-5.0-stable
  - gemfiles/Gemfile.rails-4.2-stable
  - gemfiles/Gemfile.rails-4.1-stable
+  - gemfiles/Gemfile.rails-4.0-stable
+  - gemfiles/Gemfile.rails-3.2-stable
+  - Gemfile

 matrix:
  exclude:
-    - rvm: 2.1.10
-      gemfile: Gemfile
-    - rvm: 2.1.10
-      gemfile: gemfiles/Gemfile.rails-6.0-stable
-    - rvm: 2.1.10
-      gemfile: gemfiles/Gemfile.rails-5.2-stable
-    - rvm: 2.1.10
-      gemfile: gemfiles/Gemfile.rails-5.0-stable
-    - rvm: 2.2.10
-      gemfile: Gemfile
-    - rvm: 2.2.10
-      gemfile: gemfiles/Gemfile.rails-6.0-stable
-    - rvm: 2.2.10
-      gemfile: gemfiles/Gemfile.rails-5.2-stable
-    - rvm: 2.3.8
-      gemfile: gemfiles/Gemfile.rails-6.0-stable
-    - rvm: 2.4.5
-      gemfile: gemfiles/Gemfile.rails-4.1-stable
-    - rvm: 2.4.5
-      gemfile: gemfiles/Gemfile.rails-6.0-stable
-    - rvm: 2.5.3
-      gemfile: gemfiles/Gemfile.rails-4.1-stable
-    - rvm: 2.6.0
-      gemfile: gemfiles/Gemfile.rails-4.1-stable
-    - rvm: 2.6.0
-      gemfile: gemfiles/Gemfile.rails-4.2-stable
-    - rvm: ruby-head
-      gemfile: gemfiles/Gemfile.rails-4.1-stable
-    - rvm: ruby-head
-      gemfile: gemfiles/Gemfile.rails-4.2-stable
-    - env: DEVISE_ORM=mongoid
-      gemfile: Gemfile
-    - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-5.0-stable
-    - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-5.2-stable
-    - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-6.0-stable
-  allow_failures:
-    - rvm: ruby-head
-    - gemfile: gemfiles/Gemfile.rails-6.0-stable
+    - rvm: 2.2
+      gemfile: gemfiles/Gemfile.rails-3.2-stable

 services:
  - mongodb

+sudo: false
+
 cache: bundler

 env:
  matrix:
-    - DEVISE_ORM=active_record
    - DEVISE_ORM=mongoid
+    - DEVISE_ORM=active_record

-before_install:
-  - gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true
-  - gem install bundler -v '< 2'
-  - "rm ${BUNDLE_GEMFILE}.lock"
+before_install: "rm ${BUNDLE_GEMFILE}.lock"

 before_script: "bundle update"

-script: "bin/test"
+script: "bundle exec rake test"

 notifications:
  email: false
  slack:
-    on_pull_requests: false
    on_success: change
    on_failure: always
    secure: Q3M+kmude3FjisibEeeGe0wSMXgvwLH+vL7Zrx9//q4QtkfnrQ/BBMvY9KXxPEsNF+eys4YopYjTkJ8uRmeboUATW/oQ4Jrv3+u3zkIHK2sFn/Q2cQWpK5w+CbgEnHPjKYnUu34b09njXTgDlr/mqtbPqrKeZ1dLlpKXCB/q4GY=
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,79 +1,16 @@
-# How to contribute to Devise
+### Please read before contributing

-Thanks for your interest on contributing to Devise! Here are a few general
-guidelines on contributing and reporting bugs to Devise that we ask you to
-take a look first. Notice that all of your interactions in the project are
-expected to follow our [Code of Conduct](CODE_OF_CONDUCT.md).
+1) Do not post questions in the issues tracker. If you have any questions about Devise, search the [Wiki](https://github.com/plataformatec/devise/wiki) or use the [Mailing List](https://groups.google.com/group/plataformatec-devise) or [Stack Overflow](http://stackoverflow.com/questions/tagged/devise).

-## Reporting Issues
+2) If you find a security bug, **DO NOT** submit an issue here. Please send an e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br) instead.

-Before reporting a new issue, please be sure that the issue wasn't already
-reported or fixed by searching on GitHub through our [issues](https://github.com/plataformatec/devise/issues).
+3) Do a small search on the issues tracker before submitting your issue to see if it was already reported / fixed.

-When creating a new issue, be sure to include a **title and clear description**,
-as much relevant information as possible, and either a test case example or
-even better a **sample Rails app that replicates the issue** - Devise has a lot
-of moving parts and it's functionality can be affected by third party gems, so
-we need as much context and details as possible to identify what might be broken
-for you. We have a [test case template](guides/bug_report_templates/integration_test.rb)
-that can be used to replicate issues with minimal setup.
+4) When reporting an issue, include Rails, Devise and Warden versions. If you are getting exceptions, please include the full backtrace.

-Please do not attempt to translate Devise built in views. The views are meant
-to be a starting point for fresh apps and not production material - eventually
-all applications will require custom views where you can write your own copy and
-translate it if the application requires it . For historical references, please look into closed
-[Issues/Pull Requests](https://github.com/plataformatec/devise/issues?q=i18n) regarding
-internationalization.
+5) Notice that all of your interactions in the project are expected to follow our [Code of Conduct](CODE_OF_CONDUCT.md)

-Avoid opening new issues to ask questions in our issues tracker. Please go through
-the project wiki, documentation and source code first, or try to ask your question
-on [Stack Overflow](http://stackoverflow.com/questions/tagged/devise).
+That's it! The more information you give, the easier it becomes for us to track it down and fix it.
+Ideally, you should provide an application that reproduces the error or a test case to Devise's suite.

-**If you find a security bug, do not report it through GitHub. Please send an
-e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
-instead.**
-
-## Sending Pull Requests
-
-Before sending a new Pull Request, take a look on existing Pull Requests and Issues
-to see if the proposed change or fix has been discussed in the past, or if the
-change was already implemented but not yet released.
-
-We expect new Pull Requests to include enough tests for new or changed behavior,
-and we aim to maintain everything as most backwards compatible as possible,
-reserving breaking changes to be ship in major releases when necessary - you
-can wrap the new code path with a setting toggle from the `Devise` module defined
-as `false` by default to require developers to opt-in for the new behavior.
-
-If your Pull Request includes new or changed behavior, be sure that the changes
-are beneficial to a wide range of use cases or it's an application specific change
-that might not be so valuable to other applications. Some changes can be introduced
-as a new `devise-something` gem instead of belonging to the main codebase.
-
-When adding new settings, you can take advantage of the [`Devise::Models.config`](https://github.com/plataformatec/devise/blob/245b1f9de0b3386b7913e14b60ea24f43b77feb0/lib/devise/models.rb#L13-L50) method to add class and instance level fallbacks
-to the new setting.
-
-We also welcome Pull Requests that improve our existing documentation (both our
-`README.md` and the RDoc sections in the source code) or improve existing rough
-edges in our API that might be blocking existing integrations or 3rd party gems.
-
-## Other ways to contribute
-
-We welcome anyone that wants to contribute to Devise to triage and reply to
-open issues to help troubleshoot and fix existing bugs on Devise. Here is what
-you can do:
-
-* Help ensure that existing issues follows the recommendations from the
-_[Reporting Issues](#reporting-issues)_ section, providing feedback to the issue's
-author on what might be missing.
-* Review and update the existing content of our [Wiki](https://github.com/plataformatec/devise/wiki)
-with up to date instructions and code samples - the wiki was grown with several
-different tutorials and references that we can't keep track of everything, so if
-there is a page that showcases an integration or customization that you are
-familiar with feel free to update it as necessary.
-* Review existing Pull Requests, and testing patches against real existing
-applications that use Devise.
-
-Thanks again for your interest on contributing to the project!
-
-:heart:
+Thanks!
--- a/27
+++ b/27
@@ -1,25 +1,15 @@
-# frozen_string_literal: true
-
 source "https://rubygems.org"

 gemspec

-gem "rails", "~> 5.2"
-gem "omniauth", "~> 1.3"
-gem "oauth2"
-gem "omniauth-oauth2"
+gem "rails", "4.2.2"
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"

-gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
-
-gem "rails-controller-testing"
-
-gem "responders", "~> 2.4"
-
 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
+  gem "omniauth-openid", "~> 1.0.1"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
 end
@@ -31,10 +21,9 @@ platforms :jruby do
 end

 platforms :ruby do
-  gem "sqlite3", "~> 1.3.6"
+  gem "sqlite3"
 end

-# TODO:
-# group :mongoid do
-#   gem "mongoid", "~> 4.0.0"
-# end
+group :mongoid do
+  gem "mongoid", "~> 4.0"
+end
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,204 +1,183 @@
-GIT
-  remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: dd9c0acf26aab111ebc647cd8deb99ebc6946531
-  specs:
-    activemodel-serializers-xml (1.0.1)
-      activemodel (> 5.x)
-      activesupport (> 5.x)
-      builder (~> 3.1)
-
 PATH
  remote: .
  specs:
-    devise (4.7.1)
+    devise (3.5.5)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 3.2.6, < 5)
      responders
+      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (5.2.0)
-      actionpack (= 5.2.0)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.0)
-      actionpack (= 5.2.0)
-      actionview (= 5.2.0)
-      activejob (= 5.2.0)
+    actionmailer (4.2.2)
+      actionpack (= 4.2.2)
+      actionview (= 4.2.2)
+      activejob (= 4.2.2)
      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (5.2.0)
-      actionview (= 5.2.0)
-      activesupport (= 5.2.0)
-      rack (~> 2.0)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.0)
-      activesupport (= 5.2.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.2)
+      actionview (= 4.2.2)
+      activesupport (= 4.2.2)
+      rack (~> 1.6)
+      rack-test (~> 0.6.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.1)
+    actionview (4.2.2)
+      activesupport (= 4.2.2)
      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.0)
-      activesupport (= 5.2.0)
-      globalid (>= 0.3.6)
-    activemodel (5.2.0)
-      activesupport (= 5.2.0)
-    activerecord (5.2.0)
-      activemodel (= 5.2.0)
-      activesupport (= 5.2.0)
-      arel (>= 9.0)
-    activestorage (5.2.0)
-      actionpack (= 5.2.0)
-      activerecord (= 5.2.0)
-      marcel (~> 0.3.1)
-    activesupport (5.2.0)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.1)
+    activejob (4.2.2)
+      activesupport (= 4.2.2)
+      globalid (>= 0.3.0)
+    activemodel (4.2.2)
+      activesupport (= 4.2.2)
+      builder (~> 3.1)
+    activerecord (4.2.2)
+      activemodel (= 4.2.2)
+      activesupport (= 4.2.2)
+      arel (~> 6.0)
+    activesupport (4.2.2)
+      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    arel (9.0.0)
-    bcrypt (3.1.13)
-    builder (3.2.3)
-    concurrent-ruby (1.0.5)
-    crass (1.0.4)
-    erubi (1.7.1)
-    faraday (0.11.0)
+    arel (6.0.0)
+    bcrypt (3.1.10)
+    bson (3.1.2)
+    builder (3.2.2)
+    connection_pool (2.2.0)
+    erubis (2.7.0)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    globalid (0.4.1)
-      activesupport (>= 4.2.0)
-    hashie (3.5.7)
-    i18n (1.0.0)
-      concurrent-ruby (~> 1.0)
-    jwt (1.5.6)
-    loofah (2.2.2)
-      crass (~> 1.0.2)
+    globalid (0.3.5)
+      activesupport (>= 4.1.0)
+    hashie (3.4.0)
+    i18n (0.7.0)
+    json (1.8.3)
+    jwt (1.4.1)
+    loofah (2.0.2)
      nokogiri (>= 1.5.9)
-    mail (2.7.0)
-      mini_mime (>= 0.1.1)
-    marcel (0.3.2)
-      mimemagic (~> 0.3.2)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    method_source (0.9.0)
-    mimemagic (0.3.2)
-    mini_mime (1.0.0)
-    mini_portile2 (2.3.0)
-    minitest (5.11.3)
-    mocha (1.2.1)
+    mime-types (2.6.1)
+    mini_portile (0.6.2)
+    minitest (5.7.0)
+    mocha (1.1.0)
      metaclass (~> 0.0.1)
-    multi_json (1.12.1)
-    multi_xml (0.6.0)
+    mongoid (4.0.2)
+      activemodel (~> 4.0)
+      moped (~> 2.0.0)
+      origin (~> 2.1)
+      tzinfo (>= 0.3.37)
+    moped (2.0.6)
+      bson (~> 3.0)
+      connection_pool (~> 2.0)
+      optionable (~> 0.2.0)
+    multi_json (1.11.1)
+    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nio4r (2.3.0)
-    nokogiri (1.8.2)
-      mini_portile2 (~> 2.3.0)
-    oauth2 (1.3.1)
-      faraday (>= 0.8, < 0.12)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.8.1)
-      hashie (>= 3.4.6, < 3.6.0)
-      rack (>= 1.6.2, < 3)
-    omniauth-facebook (4.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
+    optionable (0.2.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (2.0.4)
+    rack (1.6.2)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
-    rack-test (1.0.0)
-      rack (>= 1.0, < 3)
-    rails (5.2.0)
-      actioncable (= 5.2.0)
-      actionmailer (= 5.2.0)
-      actionpack (= 5.2.0)
-      actionview (= 5.2.0)
-      activejob (= 5.2.0)
-      activemodel (= 5.2.0)
-      activerecord (= 5.2.0)
-      activestorage (= 5.2.0)
-      activesupport (= 5.2.0)
-      bundler (>= 1.3.0)
-      railties (= 5.2.0)
-      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.1)
-      actionpack (~> 5.x)
-      actionview (~> 5.x)
-      activesupport (~> 5.x)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.2, >= 2.2.2)
-    railties (5.2.0)
-      actionpack (= 5.2.0)
-      activesupport (= 5.2.0)
-      method_source
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rails (4.2.2)
+      actionmailer (= 4.2.2)
+      actionpack (= 4.2.2)
+      actionview (= 4.2.2)
+      activejob (= 4.2.2)
+      activemodel (= 4.2.2)
+      activerecord (= 4.2.2)
+      activesupport (= 4.2.2)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.2.2)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.6)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.2)
+      loofah (~> 2.0)
+    railties (4.2.2)
+      actionpack (= 4.2.2)
+      activesupport (= 4.2.2)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (12.3.1)
-    rdoc (5.1.0)
-    responders (2.4.0)
-      actionpack (>= 4.2.0, < 5.3)
-      railties (>= 4.2.0, < 5.3)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (2.1.1)
+      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.7.1)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.1)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.13)
-    thor (0.20.0)
-    thread_safe (0.3.6)
-    timecop (0.8.1)
-    tzinfo (1.2.5)
+    sprockets (3.2.0)
+      rack (~> 1.0)
+    sprockets-rails (2.3.1)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.7)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
      rack (>= 1.0)
      rack-test (>= 0.5.3)
-    websocket-driver (0.7.0)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.3)

 PLATFORMS
  ruby

 DEPENDENCIES
-  activemodel-serializers-xml!
  activerecord-jdbc-adapter
  activerecord-jdbcsqlite3-adapter
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  oauth2
-  omniauth (~> 1.3)
+  mongoid (~> 4.0)
+  omniauth (~> 1.2.0)
  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
-  rails (~> 5.2)
-  rails-controller-testing
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
+  rails (= 4.2.2)
  rdoc
-  responders (~> 2.4)
-  sqlite3 (~> 1.3.6)
-  timecop
+  sqlite3
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.17.3
+   1.11.2
--- a/ISSUE_TEMPLATE.md
+++ b/ISSUE_TEMPLATE.md
@@ -1,20 +0,0 @@
-## Pre-check
-
- Do not use the issues tracker for help or support, try Stack Overflow.
- For bugs, do a quick search and make sure the bug has not yet been reported
- If you found a security bug, do not report it through GitHub. Please send an e-mail to opensource@plataformatec.com.br instead.
- Finally, be nice and have fun!
-
-## Environment
-
- Ruby **[version]**
- Rails **[version]**
- Devise **[version]**
-
-## Current behavior
-
-Include code samples, errors, steps to reproduce the error and stack traces if appropriate.
-
-Will be even more helpful if you provide a sample application or a test case that reproduces the error.
-
-## Expected behavior
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-Copyright 2009-2019 Plataformatec. http://plataformatec.com.br
+Copyright 2009-2015 Plataformatec. http://plataformatec.com.br

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ By [Plataformatec](http://plataformatec.com.br/).

 [![Build Status](https://api.travis-ci.org/plataformatec/devise.svg?branch=master)](http://travis-ci.org/plataformatec/devise)
 [![Code Climate](https://codeclimate.com/github/plataformatec/devise.svg)](https://codeclimate.com/github/plataformatec/devise)
+[![Security](https://hakiri.io/github/plataformatec/devise/master.svg)](https://hakiri.io/github/plataformatec/devise/master)

 This README is [also available in a friendly navigable format](http://devise.plataformatec.com.br/).

@@ -16,56 +17,18 @@ Devise is a flexible authentication solution for Rails based on Warden. It:

 It's composed of 10 modules:

-* [Database Authenticatable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
-* [Omniauthable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable): adds OmniAuth (https://github.com/omniauth/omniauth) support.
-* [Confirmable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable): sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
-* [Recoverable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Recoverable): resets the user password and sends reset instructions.
-* [Registerable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Registerable): handles signing up users through a registration process, also allowing them to edit and destroy their account.
-* [Rememberable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Rememberable): manages generating and clearing a token for remembering the user from a saved cookie.
-* [Trackable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Trackable): tracks sign in count, timestamps and IP address.
-* [Timeoutable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable): expires sessions that have not been active in a specified period of time.
-* [Validatable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable): provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
-* [Lockable](http://www.rubydoc.info/github/plataformatec/devise/master/Devise/Models/Lockable): locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
-
-## Table of Contents
-
-<!-- TOC depthFrom:1 depthTo:6 withLinks:1 orderedList:0 -->
-
- [Information](#information)
-	- [The Devise wiki](#the-devise-wiki)
-	- [Bug reports](#bug-reports)
-	- [StackOverflow and Mailing List](#stackoverflow-and-mailing-list)
-	- [RDocs](#rdocs)
-	- [Example applications](#example-applications)
-	- [Extensions](#extensions)
-	- [Contributing](#contributing)
- [Starting with Rails?](#starting-with-rails)
- [Getting started](#getting-started)
-	- [Controller filters and helpers](#controller-filters-and-helpers)
-	- [Configuring Models](#configuring-models)
-	- [Strong Parameters](#strong-parameters)
-	- [Configuring views](#configuring-views)
-	- [Configuring controllers](#configuring-controllers)
-	- [Configuring routes](#configuring-routes)
-	- [I18n](#i18n)
-	- [Test helpers](#test-helpers)
-	- [Controller tests](#controller-tests)
-	- [Integration tests](#integration-tests)
-	- [OmniAuth](#omniauth)
-	- [Configuring multiple models](#configuring-multiple-models)
-	- [ActiveJob Integration](#activejob-integration)
-	- [Password reset tokens and Rails logs](#password-reset-tokens-and-rails-logs)
-	- [Other ORMs](#other-orms)
-	- [Rails API mode](#rails-api-mode)
- [Additional information](#additional-information)
-	- [Heroku](#heroku)
-	- [Warden](#warden)
-	- [Contributors](#contributors)
- [License](#license)
-
-<!-- /TOC -->
-
+* [Database Authenticatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): encrypts and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
+* [Omniauthable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable): adds OmniAuth (https://github.com/intridea/omniauth) support.
+* [Confirmable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable): sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
+* [Recoverable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Recoverable): resets the user password and sends reset instructions.
+* [Registerable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Registerable): handles signing up users through a registration process, also allowing them to edit and destroy their account.
+* [Rememberable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Rememberable): manages generating and clearing a token for remembering the user from a saved cookie.
+* [Trackable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Trackable): tracks sign in count, timestamps and IP address.
+* [Timeoutable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable): expires sessions that have not been active in a specified period of time.
+* [Validatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable): provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
+* [Lockable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Lockable): locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.

+Devise is guaranteed to be thread-safe on YARV. Thread-safety support on JRuby is in progress.

 ## Information

@@ -83,13 +46,9 @@ https://github.com/plataformatec/devise/wiki/Bug-reports

 If you have discovered a security related bug, please do *NOT* use the GitHub issue tracker. Send an email to opensource@plataformatec.com.br.

-### StackOverflow and Mailing List
+### Mailing list

-If you have any questions, comments, or concerns, please use StackOverflow instead of the GitHub issue tracker:
-
-http://stackoverflow.com/questions/tagged/devise
-
-The deprecated mailing list can still be read on
+If you have any questions, comments, or concerns, please use the Google Group instead of the GitHub issue tracker:

 https://groups.google.com/group/plataformatec-devise

@@ -119,54 +78,7 @@ We hope that you will consider contributing to Devise. Please read this short ov

 https://github.com/plataformatec/devise/wiki/Contributing

-You will usually want to write tests for your changes.  To run the test suite, go into Devise's top-level directory and run `bundle install` and `bin/test`.
-Devise works with multiple Ruby and Rails versions, and ActiveRecord and Mongoid ORMs, which means you can run the test suite with some modifiers: `DEVISE_ORM` and `BUNDLE_GEMFILE`.
-
-### DEVISE_ORM
-Since Devise support both Mongoid and ActiveRecord, we rely on this variable to run specific code for each ORM.
-The default value of `DEVISE_ORM` is `active_record`. To run the tests for mongoid, you can pass `mongoid`:
-```
-DEVISE_ORM=mongoid bin/test
-
-==> Devise.orm = :mongoid
-```
-When running the tests for Mongoid, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
-
-Please note that the command output will show the variable value being used.
-
-### BUNDLE_GEMFILE
-We can use this variable to tell bundler what Gemfile it should use (instead of the one in the current directory).
-Inside the [gemfiles](https://github.com/plataformatec/devise/tree/master/gemfiles) directory, we have one for each version of Rails we support. When you send us a pull request, it may happen that the test suite breaks on Travis using some of them. If that's the case, you can simulate the same environment using the `BUNDLE_GEMFILE` variable.
-For example, if the tests broke using Ruby 2.4.2 and Rails 4.1, you can do the following:
-```bash
-rbenv shell 2.4.2 # or rvm use 2.4.2
-BUNDLE_GEMFILE=gemfiles/Gemfile.rails-4.1-stable bundle install
-BUNDLE_GEMFILE=gemfiles/Gemfile.rails-4.1-stable bin/test
-```
-
-You can also combine both of them if the tests broke for Mongoid:
-```bash
-BUNDLE_GEMFILE=gemfiles/Gemfile.rails-4.1-stable bundle install
-BUNDLE_GEMFILE=gemfiles/Gemfile.rails-4.1-stable DEVISE_ORM=mongoid bin/test
-```
-
-### Running tests
-Devise uses [Mini Test](https://github.com/seattlerb/minitest) as test framework.
-
-* Running all tests:
-```bash
-bin/test
-```
-
-* Running tests for an specific file:
-```bash
-bin/test test/models/trackable_test.rb
-```
-
-* Running a specific test given a regex:
-```bash
-bin/test test/models/trackable_test.rb:16
-```
+You will usually want to write tests for your changes.  To run the test suite, go into Devise's top-level directory and run "bundle install" and "rake".  For the tests to pass, you will need to have a MongoDB server (version 2.0 or newer) running on your system.

 ## Starting with Rails?

@@ -174,46 +86,43 @@ If you are building your first Rails application, we recommend you *do not* use

 * Michael Hartl's online book: https://www.railstutorial.org/book/modeling_users
 * Ryan Bates' Railscast: http://railscasts.com/episodes/250-authentication-from-scratch
-* Codecademy's Ruby on Rails: Authentication and Authorization: https://www.codecademy.com/learn/rails-auth
+* Codecademy's Ruby on Rails: Authentication and Authorization: http://www.codecademy.com/en/learn/rails-auth

 Once you have solidified your understanding of Rails and authentication mechanisms, we assure you Devise will be very pleasant to work with. :smiley:

 ## Getting started

-Devise 4.0 works with Rails 4.1 onwards. Add the following line to your Gemfile:
+Devise 3.0 works with Rails 3.2 onwards. You can add it to your Gemfile with:

 ```ruby
 gem 'devise'
 ```

-Then run `bundle install`
+Run the bundle command to install it.

-Next, you need to run the generator:
+After you install Devise and add it to your Gemfile, you need to run the generator:

 ```console
-$ rails generate devise:install
+rails generate devise:install
 ```

-At this point, a number of instructions will appear in the console. Among these instructions, you'll need to set up the default URL options for the Devise mailer in each environment. Here is a possible configuration for `config/environments/development.rb`:
+The generator will install an initializer which describes ALL of Devise's configuration options. It is *imperative* that you take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
+
+```console
+rails generate devise MODEL
+```
+
+Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
+
+Next, check the MODEL for any additional configuration options you might want to add, such as confirmable or lockable. If you add an option, be sure to inspect the migration file (created by the generator if your ORM supports them) and uncomment the appropriate section.  For example, if you add the confirmable option in the model, you'll need to uncomment the Confirmable section in the migration. Then run `rake db:migrate`
+
+Next, you need to set up the default URL options for the Devise mailer in each environment. Here is a possible configuration for `config/environments/development.rb`:

 ```ruby
 config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }
 ```

-The generator will install an initializer which describes ALL of Devise's configuration options. It is *imperative* that you take a look at it. When you are done, you are ready to add Devise to any of your models using the generator.
-
-
-In the following command you will replace `MODEL` with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with the default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
-
-```console
-$ rails generate devise MODEL
-```
-
-Next, check the MODEL for any additional configuration options you might want to add, such as confirmable or lockable. If you add an option, be sure to inspect the migration file (created by the generator if your ORM supports them) and uncomment the appropriate section.  For example, if you add the confirmable option in the model, you'll need to uncomment the Confirmable section in the migration.
-
-Then run `rails db:migrate`
-
-You should restart your application after changing Devise's configuration options (this includes stopping spring). Otherwise, you will run into strange errors, for example, users being unable to login and route helpers being undefined.
+You should restart your application after changing Devise's configuration options. Otherwise, you will run into strange errors, for example, users being unable to login and route helpers being undefined.

 ### Controller filters and helpers

@@ -223,8 +132,6 @@ Devise will create some helpers to use inside your controllers and views. To set
 before_action :authenticate_user!
 ```

-For Rails 5, note that `protect_from_forgery` is no longer prepended to the `before_action` chain, so if you have set `authenticate_user` before `protect_from_forgery`, your request will result in "Can't verify CSRF token authenticity." To resolve this, either change the order in which you call them, or use `protect_from_forgery prepend: true`.
-
 If your devise model is something other than User, replace "_user" with "_yourmodel". The same logic applies to the instructions below.

 To verify if a user is signed in, use the following helper:
@@ -248,7 +155,7 @@ user_session
 After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect to. For instance, when using a `:user` resource, the `user_root_path` will be used if it exists; otherwise, the default `root_path` will be used. This means that you need to set the root inside your routes:

 ```ruby
-root to: 'home#index'
+root to: "home#index"
 ```

 You can also override `after_sign_in_path_for` and `after_sign_out_path_for` to customize your redirect hooks.
@@ -267,29 +174,25 @@ member_session

 ### Configuring Models

-The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the hashing algorithm with:
+The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the encryption algorithm with:

 ```ruby
-devise :database_authenticatable, :registerable, :confirmable, :recoverable, stretches: 13
+devise :database_authenticatable, :registerable, :confirmable, :recoverable, stretches: 20
 ```

 Besides `:stretches`, you can define `:pepper`, `:encryptor`, `:confirm_within`, `:remember_for`, `:timeout_in`, `:unlock_in` among other options. For more details, see the initializer file that was created when you invoked the "devise:install" generator described above. This file is usually located at `/config/initializers/devise.rb`.

 ### Strong Parameters

-![The Parameter Sanitizer API has changed for Devise 4](http://messages.hellobits.com/warning.svg?message=The%20Parameter%20Sanitizer%20API%20has%20changed%20for%20Devise%204)
-
-*For previous Devise versions see https://github.com/plataformatec/devise/tree/3-stable#strong-parameters*
-
 When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing Devise to handle this concern at the controller as well.

-There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and default permitted parameters are:
+There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permitted parameters by default are:

 * `sign_in` (`Devise::SessionsController#create`) - Permits only the authentication keys (like `email`)
 * `sign_up` (`Devise::RegistrationsController#create`) - Permits authentication keys plus `password` and `password_confirmation`
 * `account_update` (`Devise::RegistrationsController#update`) - Permits authentication keys plus `password`, `password_confirmation` and `current_password`

-In case you want to permit additional parameters (the lazy way™), you can do so using a simple before action in your `ApplicationController`:
+In case you want to permit additional parameters (the lazy way™), you can do so using a simple before filter in your `ApplicationController`:

 ```ruby
 class ApplicationController < ActionController::Base
@@ -298,34 +201,18 @@ class ApplicationController < ActionController::Base
  protected

  def configure_permitted_parameters
-    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
+    devise_parameter_sanitizer.for(:sign_up) << :username
  end
 end
 ```

-The above works for any additional fields where the parameters are simple scalar types. If you have nested attributes (say you're using `accepts_nested_attributes_for`), then you will need to tell devise about those nestings and types:
-
-```ruby
-class ApplicationController < ActionController::Base
-  before_action :configure_permitted_parameters, if: :devise_controller?
-
-  protected
-
-  def configure_permitted_parameters
-    devise_parameter_sanitizer.permit(:sign_up, keys: [:first_name, :last_name, address_attributes: [:country, :state, :city, :area, :postal_code]])
-  end
-end
-```
-
-Devise allows you to completely change Devise defaults or invoke custom behaviour by passing a block:
+The above works for any additional fields where the parameters are simple scalar types. If you have nested attributes (say you're using `accepts_nested_attributes_for`), then you will need to tell devise about those nestings and types. Devise allows you to completely change Devise defaults or invoke custom behaviour by passing a block:

 To permit simple scalar values for username and email, use this

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.permit(:sign_in) do |user_params|
-    user_params.permit(:username, :email)
-  end
+  devise_parameter_sanitizer.for(:sign_in) { |u| u.permit(:username, :email) }
 end
 ```

@@ -333,9 +220,7 @@ If you have some checkboxes that express the roles a user may take on registrati

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.permit(:sign_up) do |user_params|
-    user_params.permit({ roles: [] }, :email, :password, :password_confirmation)
-  end
+  devise_parameter_sanitizer.for(:sign_up) { |u| u.permit({ roles: [] }, :email, :password, :password_confirmation) }
 end
 ```
 For the list of permitted scalars, and how to declare permitted keys in nested hashes and arrays, see
@@ -346,9 +231,8 @@ If you have multiple Devise models, you may want to set up a different parameter

 ```ruby
 class User::ParameterSanitizer < Devise::ParameterSanitizer
-  def initialize(*)
-    super
-    permit(:sign_up, keys: [:username, :email])
+  def sign_in
+    default_params.permit(:username, :email)
  end
 end
 ```
@@ -378,7 +262,7 @@ We built Devise to help you quickly develop an application that uses authenticat
 Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:

 ```console
-$ rails generate devise:views
+rails generate devise:views
 ```

 If you have more than one Devise model in your application (such as `User` and `Admin`), you will notice that Devise uses the same views for all models. Fortunately, Devise offers an easy way to customize views. All you need to do is set `config.scoped_views = true` inside the `config/initializers/devise.rb` file.
@@ -386,14 +270,14 @@ If you have more than one Devise model in your application (such as `User` and `
 After doing so, you will be able to have views based on the role like `users/sessions/new` and `admins/sessions/new`. If no view is found within the scope, Devise will use the default view at `devise/sessions/new`. You can also use the generator to generate scoped views:

 ```console
-$ rails generate devise:views users
+rails generate devise:views users
 ```

 If you would like to generate only a few sets of views, like the ones for the `registerable` and `confirmable` module,
 you can pass a list of modules to the generator with the `-v` flag.

 ```console
-$ rails generate devise:views -v registrations confirmations
+rails generate devise:views -v registrations confirmations
 ```

 ### Configuring controllers
@@ -403,7 +287,7 @@ If the customization at the views level is not enough, you can customize each co
 1. Create your custom controllers using the generator which requires a scope:

    ```console
-    $ rails generate devise:controllers [scope]
+    rails generate devise:controllers [scope]
    ```

    If you specify `users` as the scope, controllers will be created in `app/controllers/users/`.
@@ -418,12 +302,11 @@ If the customization at the views level is not enough, you can customize each co
      ...
    end
    ```
-    (Use the -c flag to specify a controller, for example: `rails generate devise:controllers users -c=sessions`)

 2. Tell the router to use this controller:

    ```ruby
-    devise_for :users, controllers: { sessions: 'users/sessions' }
+    devise_for :users, controllers: { sessions: "users/sessions" }
    ```

 3. Copy the views from `devise/sessions` to `users/sessions`. Since the controller was changed, it won't use the default views located in `devise/sessions`.
@@ -461,27 +344,21 @@ Remember that Devise uses flash messages to let users know if sign in was succes
 Devise also ships with default routes. If you need to customize them, you should probably be able to do it through the devise_for method. It accepts several options like :class_name, :path_prefix and so on, including the possibility to change path names for I18n:

 ```ruby
-devise_for :users, path: 'auth', path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
+devise_for :users, path: "auth", path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
 ```

-Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/plataformatec/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for) for details.
+Be sure to check `devise_for` documentation for details.

 If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is create your routes normally and wrap them in a `devise_scope` block in the router:

 ```ruby
 devise_scope :user do
-  get 'sign_in', to: 'devise/sessions#new'
+  get "sign_in", to: "devise/sessions#new"
 end
 ```

 This way, you tell Devise to use the scope `:user` when "/sign_in" is accessed. Notice `devise_scope` is also aliased as `as` in your router.

-Please note: You will still need to add `devise_for` in your routes in order to use helper methods such as `current_user`.
-
-```ruby
-devise_for :users, skip: :all
-```
-
 ### I18n

 Devise uses flash messages with I18n, in conjunction with the flash keys :notice and :alert. To customize your app, you can set up your locale file:
@@ -526,101 +403,48 @@ Caution: Devise Controllers inherit from ApplicationController. If your app uses

 ### Test helpers

-Devise includes some test helpers for controller and integration tests.
-In order to use them, you need to include the respective module in your test
-cases/specs.
-
-### Controller tests
-
-Controller tests require that you include `Devise::Test::ControllerHelpers` on
-your test case or its parent `ActionController::TestCase` superclass.
-For Rails 5, include `Devise::Test::IntegrationHelpers` instead, since the superclass
-for controller tests has been changed to ActionDispatch::IntegrationTest
-(for more details, see the [Integration tests](#integration-tests) section).
+Devise includes some test helpers for functional specs. In order to use them, you need to include Devise in your functional tests by adding the following to the bottom of your `test/test_helper.rb` file:

 ```ruby
-class PostsControllerTest < ActionController::TestCase
-  include Devise::Test::ControllerHelpers
+class ActionController::TestCase
+  include Devise::TestHelpers
 end
 ```

-If you're using RSpec, you can put the following inside a file named
-`spec/support/devise.rb` or in your `spec/spec_helper.rb` (or
-`spec/rails_helper.rb` if you are using `rspec-rails`):
+If you're using RSpec, you can put the following inside a file named `spec/support/devise.rb` or in your `spec/spec_helper.rb` (or `spec/rails_helper.rb` if you are using rspec-rails):

 ```ruby
 RSpec.configure do |config|
-  config.include Devise::Test::ControllerHelpers, type: :controller
-  config.include Devise::Test::ControllerHelpers, type: :view
+  config.include Devise::TestHelpers, type: :controller
 end
 ```

 Just be sure that this inclusion is made *after* the `require 'rspec/rails'` directive.

-Now you are ready to use the `sign_in` and `sign_out` methods on your controller
-tests:
+Now you are ready to use the `sign_in` and `sign_out` methods. Such methods have the same signature as in controllers:

 ```ruby
-sign_in @user
-sign_in @user, scope: :admin
+sign_in :user, @user   # sign_in(scope, resource)
+sign_in @user          # sign_in(resource)
+
+sign_out :user         # sign_out(scope)
+sign_out @user         # sign_out(resource)
 ```

-If you are testing Devise internal controllers or a controller that inherits
-from Devise's, you need to tell Devise which mapping should be used before a
-request. This is necessary because Devise gets this information from the router,
-but since controller tests do not pass through the router, it needs to be stated
-explicitly. For example, if you are testing the user scope, simply use:
+There are two things that are important to keep in mind:

-```ruby
-test 'GET new' do
-  # Mimic the router behavior of setting the Devise scope through the env.
-  @request.env['devise.mapping'] = Devise.mappings[:user]
+1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. Instead, fill in the form or explicitly set the user in session;

-  # Use the sign_in helper to sign in a fixture `User` record.
-  sign_in users(:alice)
+2. If you are testing Devise internal controllers or a controller that inherits from Devise's, you need to tell Devise which mapping should be used before a request. This is necessary because Devise gets this information from the router, but since functional tests do not pass through the router, it needs to be stated explicitly. For example, if you are testing the user scope, simply use:

-  get :new
-
-  # assert something
-end
-```
-
-### Integration tests
-
-Integration test helpers are available by including the
-`Devise::Test::IntegrationHelpers` module.
-
-```ruby
-class PostsTests < ActionDispatch::IntegrationTest
-  include Devise::Test::IntegrationHelpers
-end
-```
-
-Now you can use the following `sign_in` and `sign_out` methods in your integration
-tests:
-
-```ruby
-sign_in users(:bob)
-sign_in users(:bob), scope: :admin
-
-sign_out :user
-```
-
-RSpec users can include the `IntegrationHelpers` module on their `:feature` specs.
-
-```ruby
-RSpec.configure do |config|
-  config.include Devise::Test::IntegrationHelpers, type: :feature
-end
-```
-
-Unlike controller tests, integration tests do not need to supply the
-`devise.mapping` `env` value, as the mapping can be inferred by the routes that
-are executed in your tests.
+    ```ruby
+    @request.env["devise.mapping"] = Devise.mappings[:user]
+    get :new
+    ```

 You can read more about testing your Rails 3 - Rails 4 controllers with RSpec in the wiki:

-* https://github.com/plataformatec/devise/wiki/How-To:-Test-controllers-with-Rails-(and-RSpec)
+* https://github.com/plataformatec/devise/wiki/How-To:-Test-controllers-with-Rails-3-and-4-%28and-RSpec%29

 ### OmniAuth

@@ -653,7 +477,7 @@ devise :database_authenticatable, :timeoutable
 devise_for :admins

 # Inside your protected controller
-before_action :authenticate_admin!
+before_filter :authenticate_admin!

 # Inside your controllers and views
 admin_signed_in?
@@ -695,17 +519,6 @@ config.log_level = :warn

 Devise supports ActiveRecord (default) and Mongoid. To select another ORM, simply require it in the initializer file.

-### Rails API Mode
-
-Rails 5+ has a built-in [API Mode](https://edgeguides.rubyonrails.org/api_app.html) which optimizes Rails for use as an API (only). One of the side effects is that it changes the order of the middleware stack, and this can cause problems for `Devise::Test::IntegrationHelpers`. This problem usually surfaces as an ```undefined method `[]=' for nil:NilClass``` error when using integration test helpers, such as `#sign_in`. The solution is simply to reorder the middlewares by adding the following to test.rb:
-
-```ruby
-Rails.application.config.middleware.insert_before Warden::Manager, ActionDispatch::Cookies
-Rails.application.config.middleware.insert_before Warden::Manager, ActionDispatch::Session::CookieStore
-```
-
-For a deeper understanding of this, review [this issue](https://github.com/plataformatec/devise/issues/4696).
-
 ## Additional information

 ### Heroku
@@ -732,6 +545,6 @@ https://github.com/plataformatec/devise/graphs/contributors

 ## License

-MIT License. Copyright 2009-2019 Plataformatec. http://plataformatec.com.br
+MIT License. Copyright 2009-2015 Plataformatec. http://plataformatec.com.br

 You are not granted rights or licenses to the trademarks of Plataformatec, including without limitation the Devise name or logo.
--- a/1
+++ b/1
@@ -1,5 +1,4 @@
 # encoding: UTF-8
-# frozen_string_literal: true

 require 'bundler/gem_tasks'
 require 'rake/testtask'
--- a/app/controllers/devise/confirmations_controller.rb
+++ b/app/controllers/devise/confirmations_controller.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 class Devise::ConfirmationsController < DeviseController
  # GET /resource/confirmation/new
  def new
@@ -24,7 +22,7 @@ class Devise::ConfirmationsController < DeviseController
    yield resource if block_given?

    if resource.errors.empty?
-      set_flash_message!(:notice, :confirmed)
+      set_flash_message(:notice, :confirmed) if is_flashing_format?
      respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
    else
      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
--- a/app/controllers/devise/omniauth_callbacks_controller.rb
+++ b/app/controllers/devise/omniauth_callbacks_controller.rb
@@ -1,28 +1,26 @@
-# frozen_string_literal: true
-
 class Devise::OmniauthCallbacksController < DeviseController
-  prepend_before_action { request.env["devise.skip_timeout"] = true }
+  prepend_before_filter { request.env["devise.skip_timeout"] = true }

  def passthru
-    render status: 404, plain: "Not found. Authentication passthru."
+    render status: 404, text: "Not found. Authentication passthru."
  end

  def failure
-    set_flash_message! :alert, :failure, kind: OmniAuth::Utils.camelize(failed_strategy.name), reason: failure_message
+    set_flash_message :alert, :failure, kind: OmniAuth::Utils.camelize(failed_strategy.name), reason: failure_message
    redirect_to after_omniauth_failure_path_for(resource_name)
  end

  protected

  def failed_strategy
-    request.respond_to?(:get_header) ? request.get_header("omniauth.error.strategy") : request.env["omniauth.error.strategy"]
+    env["omniauth.error.strategy"]
  end

  def failure_message
-    exception = request.respond_to?(:get_header) ? request.get_header("omniauth.error") : request.env["omniauth.error"]
+    exception = env["omniauth.error"]
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
-    error ||= (request.respond_to?(:get_header) ? request.get_header("omniauth.error.type") : request.env["omniauth.error.type"]).to_s
+    error ||= env["omniauth.error.type"].to_s
    error.to_s.humanize if error
  end

--- a/app/controllers/devise/passwords_controller.rb
+++ b/app/controllers/devise/passwords_controller.rb
@@ -1,9 +1,7 @@
-# frozen_string_literal: true
-
 class Devise::PasswordsController < DeviseController
-  prepend_before_action :require_no_authentication
+  prepend_before_filter :require_no_authentication
  # Render the #edit only if coming from a reset password email link
-  append_before_action :assert_reset_token_passed, only: :edit
+  append_before_filter :assert_reset_token_passed, only: :edit

  # GET /resource/password/new
  def new
@@ -38,11 +36,10 @@ class Devise::PasswordsController < DeviseController
      resource.unlock_access! if unlockable?(resource)
      if Devise.sign_in_after_reset_password
        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-        set_flash_message!(:notice, flash_message)
-        resource.after_database_authentication
+        set_flash_message(:notice, flash_message) if is_flashing_format?
        sign_in(resource_name, resource)
      else
-        set_flash_message!(:notice, :updated_not_active)
+        set_flash_message(:notice, :updated_not_active) if is_flashing_format?
      end
      respond_with resource, location: after_resetting_password_path_for(resource)
    else
--- a/app/controllers/devise/registrations_controller.rb
+++ b/app/controllers/devise/registrations_controller.rb
@@ -1,15 +1,13 @@
-# frozen_string_literal: true
-
 class Devise::RegistrationsController < DeviseController
-  prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
-  prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]
-  prepend_before_action :set_minimum_password_length, only: [:new, :edit]
+  prepend_before_filter :require_no_authentication, only: [:new, :create, :cancel]
+  prepend_before_filter :authenticate_scope!, only: [:edit, :update, :destroy]

  # GET /resource/sign_up
  def new
-    build_resource
+    build_resource({})
+    set_minimum_password_length
    yield resource if block_given?
-    respond_with resource
+    respond_with self.resource
  end

  # POST /resource
@@ -20,11 +18,11 @@ class Devise::RegistrationsController < DeviseController
    yield resource if block_given?
    if resource.persisted?
      if resource.active_for_authentication?
-        set_flash_message! :notice, :signed_up
+        set_flash_message :notice, :signed_up if is_flashing_format?
        sign_up(resource_name, resource)
        respond_with resource, location: after_sign_up_path_for(resource)
      else
-        set_flash_message! :notice, :"signed_up_but_#{resource.inactive_message}"
+        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
        expire_data_after_sign_in!
        respond_with resource, location: after_inactive_sign_up_path_for(resource)
      end
@@ -50,13 +48,15 @@ class Devise::RegistrationsController < DeviseController
    resource_updated = update_resource(resource, account_update_params)
    yield resource if block_given?
    if resource_updated
-      set_flash_message_for_update(resource, prev_unconfirmed_email)
-      bypass_sign_in resource, scope: resource_name if sign_in_after_change_password?
-
+      if is_flashing_format?
+        flash_key = update_needs_confirmation?(resource, prev_unconfirmed_email) ?
+          :update_needs_confirmation : :updated
+        set_flash_message :notice, flash_key
+      end
+      sign_in resource_name, resource, bypass: true
      respond_with resource, location: after_update_path_for(resource)
    else
      clean_up_passwords resource
-      set_minimum_password_length
      respond_with resource
    end
  end
@@ -65,7 +65,7 @@ class Devise::RegistrationsController < DeviseController
  def destroy
    resource.destroy
    Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
-    set_flash_message! :notice, :destroyed
+    set_flash_message :notice, :destroyed if is_flashing_format?
    yield resource if block_given?
    respond_with_navigational(resource){ redirect_to after_sign_out_path_for(resource_name) }
  end
@@ -96,8 +96,8 @@ class Devise::RegistrationsController < DeviseController

  # Build a devise resource passing in the session. Useful to move
  # temporary session data to the newly created user.
-  def build_resource(hash = {})
-    self.resource = resource_class.new_with_session(hash, session)
+  def build_resource(hash=nil)
+    self.resource = resource_class.new_with_session(hash || {}, session)
  end

  # Signs in a user on sign up. You can overwrite this method in your own
@@ -109,7 +109,7 @@ class Devise::RegistrationsController < DeviseController
  # The path used after sign up. You need to overwrite this method
  # in your own RegistrationsController.
  def after_sign_up_path_for(resource)
-    after_sign_in_path_for(resource) if is_navigational_format?
+    after_sign_in_path_for(resource)
  end

  # The path used after sign up for inactive accounts. You need to overwrite
@@ -124,7 +124,7 @@ class Devise::RegistrationsController < DeviseController
  # The default url to be used after updating a resource. You need to overwrite
  # this method in your own RegistrationsController.
  def after_update_path_for(resource)
-    sign_in_after_change_password? ? signed_in_root_path(resource) : new_session_path(resource_name)
+    signed_in_root_path(resource)
  end

  # Authenticates the current scope and gets the current resource from the session.
@@ -144,25 +144,4 @@ class Devise::RegistrationsController < DeviseController
  def translation_scope
    'devise.registrations'
  end
-
-  private
-
-  def set_flash_message_for_update(resource, prev_unconfirmed_email)
-    return unless is_flashing_format?
-
-    flash_key = if update_needs_confirmation?(resource, prev_unconfirmed_email)
-                  :update_needs_confirmation
-                elsif sign_in_after_change_password?
-                  :updated
-                else
-                  :updated_but_not_signed_in
-                end
-    set_flash_message :notice, flash_key
-  end
-
-  def sign_in_after_change_password?
-    return true if account_update_params[:password].blank?
-
-    Devise.sign_in_after_change_password
-  end
 end
--- a/app/controllers/devise/sessions_controller.rb
+++ b/app/controllers/devise/sessions_controller.rb
@@ -1,10 +1,8 @@
-# frozen_string_literal: true
-
 class Devise::SessionsController < DeviseController
-  prepend_before_action :require_no_authentication, only: [:new, :create]
-  prepend_before_action :allow_params_authentication!, only: :create
-  prepend_before_action :verify_signed_out_user, only: :destroy
-  prepend_before_action(only: [:create, :destroy]) { request.env["devise.skip_timeout"] = true }
+  prepend_before_filter :require_no_authentication, only: [:new, :create]
+  prepend_before_filter :allow_params_authentication!, only: :create
+  prepend_before_filter :verify_signed_out_user, only: :destroy
+  prepend_before_filter only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }

  # GET /resource/sign_in
  def new
@@ -17,7 +15,7 @@ class Devise::SessionsController < DeviseController
  # POST /resource/sign_in
  def create
    self.resource = warden.authenticate!(auth_options)
-    set_flash_message!(:notice, :signed_in)
+    set_flash_message(:notice, :signed_in) if is_flashing_format?
    sign_in(resource_name, resource)
    yield resource if block_given?
    respond_with resource, location: after_sign_in_path_for(resource)
@@ -26,7 +24,7 @@ class Devise::SessionsController < DeviseController
  # DELETE /resource/sign_out
  def destroy
    signed_out = (Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name))
-    set_flash_message! :notice, :signed_out if signed_out
+    set_flash_message :notice, :signed_out if signed_out && is_flashing_format?
    yield if block_given?
    respond_to_on_destroy
  end
@@ -60,7 +58,7 @@ class Devise::SessionsController < DeviseController
  # to the after_sign_out path.
  def verify_signed_out_user
    if all_signed_out?
-      set_flash_message! :notice, :already_signed_out
+      set_flash_message :notice, :already_signed_out if is_flashing_format?

      respond_to_on_destroy
    end
--- a/app/controllers/devise/unlocks_controller.rb
+++ b/app/controllers/devise/unlocks_controller.rb
@@ -1,7 +1,5 @@
-# frozen_string_literal: true
-
 class Devise::UnlocksController < DeviseController
-  prepend_before_action :require_no_authentication
+  prepend_before_filter :require_no_authentication

  # GET /resource/unlock/new
  def new
@@ -26,7 +24,7 @@ class Devise::UnlocksController < DeviseController
    yield resource if block_given?

    if resource.errors.empty?
-      set_flash_message! :notice, :unlocked
+      set_flash_message :notice, :unlocked if is_flashing_format?
      respond_with_navigational(resource){ redirect_to after_unlock_path_for(resource) }
    else
      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
--- a/app/controllers/devise_controller.rb
+++ b/app/controllers/devise_controller.rb
@@ -1,20 +1,14 @@
-# frozen_string_literal: true
-
 # All Devise controllers are inherited from here.
 class DeviseController < Devise.parent_controller.constantize
  include Devise::Controllers::ScopedViews

-  if respond_to?(:helper)
-    helper DeviseHelper
-  end
+  helper DeviseHelper

-  if respond_to?(:helper_method)
-    helpers = %w(resource scope_name resource_name signed_in_resource
-                 resource_class resource_params devise_mapping)
-    helper_method(*helpers)
-  end
+  helpers = %w(resource scope_name resource_name signed_in_resource
+               resource_class resource_params devise_mapping)
+  helper_method(*helpers)

-  prepend_before_action :assert_is_devise_resource!
+  prepend_before_filter :assert_is_devise_resource!
  respond_to :html if mimes_for_respond_to.empty?

  # Override prefixes to consider the scoped view.
@@ -22,7 +16,7 @@ class DeviseController < Devise.parent_controller.constantize
  # Action Controller tests that forces _prefixes to be
  # loaded before even having a request object.
  #
-  # This method should be public as it is in ActionPack
+  # This method should be public as it is is in ActionPack
  # itself. Changing its visibility may break other gems.
  def _prefixes #:nodoc:
    @_prefixes ||= if self.class.scoped_views? && request && devise_mapping
@@ -95,10 +89,10 @@ MESSAGE
    instance_variable_set(:"@#{resource_name}", new_resource)
  end

-  # Helper for use in before_actions where no authentication is required.
+  # Helper for use in before_filters where no authentication is required.
  #
  # Example:
-  #   before_action :require_no_authentication, only: :new
+  #   before_filter :require_no_authentication, only: :new
  def require_no_authentication
    assert_is_devise_resource!
    return unless is_navigational_format?
@@ -112,7 +106,7 @@ MESSAGE
    end

    if authenticated && resource = warden.user(resource_name)
-      set_flash_message(:alert, 'already_authenticated', scope: 'devise.failure')
+      flash[:alert] = I18n.t("devise.failure.already_authenticated")
      redirect_to after_sign_in_path_for(resource)
    end
  end
@@ -129,13 +123,13 @@ MESSAGE
    end

    if notice
-      set_flash_message! :notice, notice
+      set_flash_message :notice, notice if is_flashing_format?
      true
    end
  end

  # Sets the flash message with :key, using I18n. By default you are able
-  # to set up your messages using specific resource scope, and if no message is
+  # to setup your messages using specific resource scope, and if no message is
  # found we look to the default scope. Set the "now" options key to a true
  # value to populate the flash.now hash in lieu of the default flash hash (so
  # the flash message will be available to the current action instead of the
@@ -160,13 +154,6 @@ MESSAGE
    end
  end

-  # Sets flash message if is_flashing_format? equals true
-  def set_flash_message!(key, kind, options = {})
-    if is_flashing_format?
-      set_flash_message(key, kind, options)
-    end
-  end
-
  # Sets minimum password length to show to user
  def set_minimum_password_length
    if devise_mapping.validatable?
--- a/app/helpers/devise_helper.rb
+++ b/app/helpers/devise_helper.rb
@@ -1,18 +1,25 @@
-# frozen_string_literal: true
-
 module DeviseHelper
-  # Retain this method for backwards compatibility, deprecated in favour of modifying the
-  # devise/shared/error_messages partial
+  # A simple way to show error messages for the current devise resource. If you need
+  # to customize this method, you can either overwrite it in your application helpers or
+  # copy the views to your application.
+  #
+  # This method is intended to stay simple and it is unlikely that we are going to change
+  # it to add more behavior or options.
  def devise_error_messages!
-    ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
-      [Devise] `DeviseHelper.devise_error_messages!`
-      is deprecated and it will be removed in the next major version.
-      To customize the errors styles please run `rails g devise:views` and modify the
-      `devise/shared/error_messages` partial.
-    DEPRECATION
-
    return "" if resource.errors.empty?

-    render "devise/shared/error_messages", resource: resource
+    messages = resource.errors.full_messages.map { |msg| content_tag(:li, msg) }.join
+    sentence = I18n.t("errors.messages.not_saved",
+                      count: resource.errors.count,
+                      resource: resource.class.model_name.human.downcase)
+
+    html = <<-HTML
+    <div id="error_explanation">
+      <h2>#{sentence}</h2>
+      <ul>#{messages}</ul>
+    </div>
+    HTML
+
+    html.html_safe
  end
 end
--- a/app/mailers/devise/mailer.rb
+++ b/app/mailers/devise/mailer.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 if defined?(ActionMailer)
  class Devise::Mailer < Devise.parent_mailer.constantize
    include Devise::Mailers::Helpers
@@ -19,10 +17,6 @@ if defined?(ActionMailer)
      devise_mail(record, :unlock_instructions, opts)
    end

-    def email_changed(record, opts={})
-      devise_mail(record, :email_changed, opts)
-    end
-
    def password_change(record, opts={})
      devise_mail(record, :password_change, opts)
    end
--- a/app/views/devise/confirmations/new.html.erb
+++ b/app/views/devise/confirmations/new.html.erb
@@ -1,11 +1,11 @@
 <h2>Resend confirmation instructions</h2>

 <%= form_for(resource, as: resource_name, url: confirmation_path(resource_name), html: { method: :post }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email", value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %>
+    <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %> 
  </div>

  <div class="actions">
--- a/app/views/devise/mailer/email_changed.html.erb
+++ b/app/views/devise/mailer/email_changed.html.erb
@@ -1,7 +0,0 @@
-<p>Hello <%= @email %>!</p>
-
-<% if @resource.try(:unconfirmed_email?) %>
-  <p>We're contacting you to notify you that your email is being changed to <%= @resource.unconfirmed_email %>.</p>
-<% else %>
-  <p>We're contacting you to notify you that your email has been changed to <%= @resource.email %>.</p>
-<% end %>
--- a/app/views/devise/passwords/edit.html.erb
+++ b/app/views/devise/passwords/edit.html.erb
@@ -1,7 +1,7 @@
 <h2>Change your password</h2>

 <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>
  <%= f.hidden_field :reset_password_token %>

  <div class="field">
@@ -9,12 +9,12 @@
    <% if @minimum_password_length %>
      <em>(<%= @minimum_password_length %> characters minimum)</em><br />
    <% end %>
-    <%= f.password_field :password, autofocus: true, autocomplete: "new-password" %>
+    <%= f.password_field :password, autofocus: true, autocomplete: "off" %>
  </div>

  <div class="field">
    <%= f.label :password_confirmation, "Confirm new password" %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
+    <%= f.password_field :password_confirmation, autocomplete: "off" %>
  </div>

  <div class="actions">
--- a/app/views/devise/passwords/new.html.erb
+++ b/app/views/devise/passwords/new.html.erb
@@ -1,11 +1,11 @@
 <h2>Forgot your password?</h2>

 <%= form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%= f.email_field :email, autofocus: true %>
  </div>

  <div class="actions">
--- a/app/views/devise/registrations/edit.html.erb
+++ b/app/views/devise/registrations/edit.html.erb
@@ -1,11 +1,11 @@
 <h2>Edit <%= resource_name.to_s.humanize %></h2>

 <%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%= f.email_field :email, autofocus: true %>
  </div>

  <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
@@ -14,21 +14,17 @@

  <div class="field">
    <%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
-    <%= f.password_field :password, autocomplete: "new-password" %>
-    <% if @minimum_password_length %>
-      <br />
-      <em><%= @minimum_password_length %> characters minimum</em>
-    <% end %>
+    <%= f.password_field :password, autocomplete: "off" %>
  </div>

  <div class="field">
    <%= f.label :password_confirmation %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
+    <%= f.password_field :password_confirmation, autocomplete: "off" %>
  </div>

  <div class="field">
    <%= f.label :current_password %> <i>(we need your current password to confirm your changes)</i><br />
-    <%= f.password_field :current_password, autocomplete: "current-password" %>
+    <%= f.password_field :current_password, autocomplete: "off" %>
  </div>

  <div class="actions">
--- a/app/views/devise/registrations/new.html.erb
+++ b/app/views/devise/registrations/new.html.erb
@@ -1,11 +1,11 @@
 <h2>Sign up</h2>

 <%= form_for(resource, as: resource_name, url: registration_path(resource_name)) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%= f.email_field :email, autofocus: true %>
  </div>

  <div class="field">
@@ -13,12 +13,12 @@
    <% if @minimum_password_length %>
    <em>(<%= @minimum_password_length %> characters minimum)</em>
    <% end %><br />
-    <%= f.password_field :password, autocomplete: "new-password" %>
+    <%= f.password_field :password, autocomplete: "off" %>
  </div>

  <div class="field">
    <%= f.label :password_confirmation %><br />
-    <%= f.password_field :password_confirmation, autocomplete: "new-password" %>
+    <%= f.password_field :password_confirmation, autocomplete: "off" %>
  </div>

  <div class="actions">
--- a/app/views/devise/sessions/new.html.erb
+++ b/app/views/devise/sessions/new.html.erb
@@ -3,20 +3,20 @@
 <%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%= f.email_field :email, autofocus: true %>
  </div>

  <div class="field">
    <%= f.label :password %><br />
-    <%= f.password_field :password, autocomplete: "current-password" %>
+    <%= f.password_field :password, autocomplete: "off" %>
  </div>

-  <% if devise_mapping.rememberable? %>
+  <% if devise_mapping.rememberable? -%>
    <div class="field">
      <%= f.check_box :remember_me %>
      <%= f.label :remember_me %>
    </div>
-  <% end %>
+  <% end -%>

  <div class="actions">
    <%= f.submit "Log in" %>
--- a/app/views/devise/shared/_error_messages.html.erb
+++ b/app/views/devise/shared/_error_messages.html.erb
@@ -1,15 +0,0 @@
-<% if resource.errors.any? %>
-  <div id="error_explanation">
-    <h2>
-      <%= I18n.t("errors.messages.not_saved",
-                 count: resource.errors.count,
-                 resource: resource.class.model_name.human.downcase)
-       %>
-    </h2>
-    <ul>
-      <% resource.errors.full_messages.each do |message| %>
-        <li><%= message %></li>
-      <% end %>
-    </ul>
-  </div>
-<% end %>
--- a/app/views/devise/shared/_links.html.erb
+++ b/app/views/devise/shared/_links.html.erb
@@ -1,25 +1,25 @@
 <%- if controller_name != 'sessions' %>
  <%= link_to "Log in", new_session_path(resource_name) %><br />
-<% end %>
+<% end -%>

 <%- if devise_mapping.registerable? && controller_name != 'registrations' %>
  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
-<% end %>
+<% end -%>

 <%- if devise_mapping.recoverable? && controller_name != 'passwords' && controller_name != 'registrations' %>
  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
-<% end %>
+<% end -%>

 <%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
-<% end %>
+<% end -%>

 <%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
-<% end %>
+<% end -%>

 <%- if devise_mapping.omniauthable? %>
  <%- resource_class.omniauth_providers.each do |provider| %>
    <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider) %><br />
-  <% end %>
-<% end %>
+  <% end -%>
+<% end -%>
--- a/app/views/devise/unlocks/new.html.erb
+++ b/app/views/devise/unlocks/new.html.erb
@@ -1,11 +1,11 @@
 <h2>Resend unlock instructions</h2>

 <%= form_for(resource, as: resource_name, url: unlock_path(resource_name), html: { method: :post }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+  <%= devise_error_messages! %>

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%= f.email_field :email, autofocus: true %>
  </div>

  <div class="actions">
--- a/bin/test
+++ b/bin/test
@@ -1,17 +0,0 @@
-#!/usr/bin/env ruby
-$: << File.expand_path(File.expand_path('../../test', __FILE__))
-
-# Remove this begin/rescue once Rails 4 support is removed.
-begin
-  require 'bundler/setup'
-  require 'rails/test_unit/runner'
-  require 'rails/test_unit/reporter'
-  require 'rails/test_unit/line_filtering'
-
-  Rails::TestUnitReporter.executable = 'bin/test'
-
-  Rails::TestUnit::Runner.parse_options(ARGV)
-  Rails::TestUnit::Runner.run(ARGV)
-rescue LoadError
-  exec 'rake'
-end
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -23,8 +23,6 @@ en:
        subject: "Reset password instructions"
      unlock_instructions:
        subject: "Unlock instructions"
-      email_changed:
-        subject: "Email Changed"
      password_change:
        subject: "Password Changed"
    omniauth_callbacks:
@@ -42,9 +40,8 @@ en:
      signed_up_but_inactive: "You have signed up successfully. However, we could not sign you in because your account is not yet activated."
      signed_up_but_locked: "You have signed up successfully. However, we could not sign you in because your account is locked."
      signed_up_but_unconfirmed: "A message with a confirmation link has been sent to your email address. Please follow the link to activate your account."
-      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and follow the confirmation link to confirm your new email address."
+      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and follow the confirm link to confirm your new email address."
      updated: "Your account has been updated successfully."
-      updated_but_not_signed_in: "Your account has been updated successfully, but since your password was changed, you need to sign in again"
    sessions:
      signed_in: "Signed in successfully."
      signed_out: "Signed out successfully."
--- a/devise.gemspec
+++ b/devise.gemspec
@@ -1,6 +1,4 @@
 # -*- encoding: utf-8 -*-
-# frozen_string_literal: true
-
 $:.push File.expand_path("../lib", __FILE__)
 require "devise/version"

@@ -15,13 +13,15 @@ Gem::Specification.new do |s|
  s.description = "Flexible authentication solution for Rails with Warden"
  s.authors     = ['José Valim', 'Carlos Antônio']

-  s.files         = Dir["{app,config,lib}/**/*", "CHANGELOG.md", "MIT-LICENSE", "README.md"]
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- test/*`.split("\n")
  s.require_paths = ["lib"]
-  s.required_ruby_version = '>= 2.1.0'
+  s.required_ruby_version = '>= 1.9.3'

  s.add_dependency("warden", "~> 1.2.3")
  s.add_dependency("orm_adapter", "~> 0.1")
  s.add_dependency("bcrypt", "~> 3.0")
-  s.add_dependency("railties", ">= 4.1.0")
+  s.add_dependency("thread_safe", "~> 0.1")
+  s.add_dependency("railties", ">= 3.2.6", "< 5")
  s.add_dependency("responders")
 end
--- a/gemfiles/Gemfile.rails-3.2-stable
+++ b/gemfiles/Gemfile.rails-3.2-stable
@@ -0,0 +1,29 @@
+source "https://rubygems.org"
+
+gemspec path: '..'
+
+gem "rails", github: 'rails/rails', branch: '3-2-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
+gem "rdoc"
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
+  gem "webrat", "0.7.3", require: false
+  gem "mocha", "~> 1.1", require: false
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3"
+end
+
+group :mongoid do
+  gem "mongoid", "~> 3.0"
+end
--- a/gemfiles/Gemfile.rails-3.2-stable.lock
+++ b/gemfiles/Gemfile.rails-3.2-stable.lock
@@ -0,0 +1,172 @@
+GIT
+  remote: git://github.com/rails/rails.git
+  revision: b344986bc3d94ca7821fc5e0eef1874882ac6cbb
+  branch: 3-2-stable
+  specs:
+    actionmailer (3.2.21)
+      actionpack (= 3.2.21)
+      mail (~> 2.5.4)
+    actionpack (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      journey (~> 1.0.4)
+      rack (~> 1.4.5)
+      rack-cache (~> 1.2)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.2.1)
+    activemodel (3.2.21)
+      activesupport (= 3.2.21)
+      builder (~> 3.0.0)
+    activerecord (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+      arel (~> 3.0.2)
+      tzinfo (~> 0.3.29)
+    activeresource (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+    activesupport (3.2.21)
+      i18n (~> 0.6, >= 0.6.4)
+      multi_json (~> 1.0)
+    rails (3.2.21)
+      actionmailer (= 3.2.21)
+      actionpack (= 3.2.21)
+      activerecord (= 3.2.21)
+      activeresource (= 3.2.21)
+      activesupport (= 3.2.21)
+      bundler (~> 1.0)
+      railties (= 3.2.21)
+    railties (3.2.21)
+      actionpack (= 3.2.21)
+      activesupport (= 3.2.21)
+      rack-ssl (~> 1.3.2)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (>= 0.14.6, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.3)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    arel (3.0.3)
+    bcrypt (3.1.10)
+    builder (3.0.4)
+    erubis (2.7.0)
+    faraday (0.9.1)
+      multipart-post (>= 1.2, < 3)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    journey (1.0.4)
+    json (1.8.2)
+    jwt (1.4.1)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    metaclass (0.0.4)
+    mime-types (1.25.1)
+    mini_portile (0.6.2)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    mongoid (3.1.6)
+      activemodel (~> 3.2)
+      moped (~> 1.4)
+      origin (~> 1.0)
+      tzinfo (~> 0.3.29)
+    moped (1.5.2)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    origin (1.1.0)
+    orm_adapter (0.5.0)
+    polyglot (0.3.5)
+    rack (1.4.5)
+    rack-cache (1.2)
+      rack (>= 0.4)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-ssl (1.3.4)
+      rack
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rake (10.4.2)
+    rdoc (3.12.2)
+      json (~> 1.4)
+    responders (1.1.2)
+      railties (>= 3.2, < 4.2)
+    ruby-openid (2.7.0)
+    sprockets (2.2.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.43)
+    warden (1.2.4)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  mongoid (~> 3.0)
+  omniauth (~> 1.2.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
+  rails!
+  rdoc
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.0-stable
+++ b/gemfiles/Gemfile.rails-4.0-stable
@@ -0,0 +1,29 @@
+source "https://rubygems.org"
+
+gemspec path: '..'
+
+gem "rails", github: 'rails/rails', branch: '4-0-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
+gem "rdoc"
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
+  gem "webrat", "0.7.3", require: false
+  gem "mocha", "~> 1.1", require: false
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3"
+end
+
+group :mongoid do
+  gem "mongoid", "~> 4.0.0"
+end
--- a/gemfiles/Gemfile.rails-4.0-stable.lock
+++ b/gemfiles/Gemfile.rails-4.0-stable.lock
@@ -0,0 +1,166 @@
+GIT
+  remote: git://github.com/rails/rails.git
+  revision: 7ec9c9635bf4d57009135ed11e89d8bf32306d73
+  branch: 4-0-stable
+  specs:
+    actionmailer (4.0.13)
+      actionpack (= 4.0.13)
+      mail (~> 2.5, >= 2.5.4)
+    actionpack (4.0.13)
+      activesupport (= 4.0.13)
+      builder (~> 3.1.0)
+      erubis (~> 2.7.0)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    activemodel (4.0.13)
+      activesupport (= 4.0.13)
+      builder (~> 3.1.0)
+    activerecord (4.0.13)
+      activemodel (= 4.0.13)
+      activerecord-deprecated_finders (~> 1.0.2)
+      activesupport (= 4.0.13)
+      arel (~> 4.0.0)
+    activesupport (4.0.13)
+      i18n (~> 0.6, >= 0.6.9)
+      minitest (~> 4.2)
+      multi_json (~> 1.3)
+      thread_safe (~> 0.1)
+      tzinfo (~> 0.3.37)
+    rails (4.0.13)
+      actionmailer (= 4.0.13)
+      actionpack (= 4.0.13)
+      activerecord (= 4.0.13)
+      activesupport (= 4.0.13)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.0.13)
+      sprockets-rails (~> 2.0)
+    railties (4.0.13)
+      actionpack (= 4.0.13)
+      activesupport (= 4.0.13)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.3)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activerecord-deprecated_finders (1.0.3)
+    arel (4.0.2)
+    bcrypt (3.1.10)
+    bson (2.3.0)
+    builder (3.1.4)
+    connection_pool (2.1.3)
+    erubis (2.7.0)
+    faraday (0.9.1)
+      multipart-post (>= 1.2, < 3)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    jwt (1.4.1)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    metaclass (0.0.4)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (4.7.5)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    mongoid (4.0.2)
+      activemodel (~> 4.0)
+      moped (~> 2.0.0)
+      origin (~> 2.1)
+      tzinfo (>= 0.3.37)
+    moped (2.0.4)
+      bson (~> 2.2)
+      connection_pool (~> 2.0)
+      optionable (~> 0.2.0)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    optionable (0.2.0)
+    origin (2.1.1)
+    orm_adapter (0.5.0)
+    rack (1.5.2)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (1.1.2)
+      railties (>= 3.2, < 4.2)
+    ruby-openid (2.7.0)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
+    tzinfo (0.3.43)
+    warden (1.2.4)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  mongoid (~> 4.0.0)
+  omniauth (~> 1.2.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
+  rails!
+  rdoc
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.1-stable
+++ b/gemfiles/Gemfile.rails-4.1-stable
@@ -1,23 +1,17 @@
-# frozen_string_literal: true
-
 source "https://rubygems.org"

-gemspec path: ".."
+gemspec path: '..'

-gem "rails", github: "rails/rails", branch: "4-1-stable"
-gem "omniauth"
-gem "omniauth-oauth2"
-gem "rdoc", "~> 5.1"
-# Force this version because it's breaking on CI since a higher nokogiri version requires Ruby 2.3+.
-gem "nokogiri", "1.9.1"
+gem "rails", github: 'rails/rails', branch: '4-1-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
+gem "rdoc"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
+  gem "omniauth-openid", "~> 1.0.1"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
-  gem 'test_after_commit', require: false
 end

 platforms :jruby do
@@ -27,9 +21,9 @@ platforms :jruby do
 end

 platforms :ruby do
-  gem "sqlite3", "~> 1.3.6"
+  gem "sqlite3"
 end

 group :mongoid do
-  gem "mongoid", "~> 4.0"
+  gem "mongoid", "~> 4.0.0"
 end
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -1,147 +1,148 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: 0cad778c2605a5204a05a9f1dbd3344e39f248d8
+  revision: bf32ec7b8611e6b4c7e9398f7d297a1f0221e9b9
  branch: 4-1-stable
  specs:
-    actionmailer (4.1.16)
-      actionpack (= 4.1.16)
-      actionview (= 4.1.16)
+    actionmailer (4.1.10)
+      actionpack (= 4.1.10)
+      actionview (= 4.1.10)
      mail (~> 2.5, >= 2.5.4)
-    rails (4.1.16)
-      actionmailer (= 4.1.16)
-      actionpack (= 4.1.16)
-      actionview (= 4.1.16)
-      activemodel (= 4.1.16)
-      activerecord (= 4.1.16)
-      activesupport (= 4.1.16)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.16)
-      sprockets-rails (~> 2.0)
-
-PATH
-  remote: ..
-  specs:
-    devise (4.7.1)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
-      responders
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actionpack (4.1.16)
-      actionview (= 4.1.16)
-      activesupport (= 4.1.16)
+    actionpack (4.1.10)
+      actionview (= 4.1.10)
+      activesupport (= 4.1.10)
      rack (~> 1.5.2)
      rack-test (~> 0.6.2)
-    actionview (4.1.16)
-      activesupport (= 4.1.16)
+    actionview (4.1.10)
+      activesupport (= 4.1.10)
      builder (~> 3.1)
      erubis (~> 2.7.0)
-    activemodel (4.1.16)
-      activesupport (= 4.1.16)
+    activemodel (4.1.10)
+      activesupport (= 4.1.10)
      builder (~> 3.1)
-    activerecord (4.1.16)
-      activemodel (= 4.1.16)
-      activesupport (= 4.1.16)
+    activerecord (4.1.10)
+      activemodel (= 4.1.10)
+      activesupport (= 4.1.10)
      arel (~> 5.0.0)
-    activesupport (4.1.16)
+    activesupport (4.1.10)
      i18n (~> 0.6, >= 0.6.9)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.1)
      tzinfo (~> 1.1)
+    rails (4.1.10)
+      actionmailer (= 4.1.10)
+      actionpack (= 4.1.10)
+      actionview (= 4.1.10)
+      activemodel (= 4.1.10)
+      activerecord (= 4.1.10)
+      activesupport (= 4.1.10)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.10)
+      sprockets-rails (~> 2.0)
+    railties (4.1.10)
+      actionpack (= 4.1.10)
+      activesupport (= 4.1.10)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.3)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
    arel (5.0.1.20140414130214)
-    bcrypt (3.1.13)
-    bson (3.2.6)
-    builder (3.2.3)
-    concurrent-ruby (1.0.5)
-    connection_pool (2.2.1)
+    bcrypt (3.1.10)
+    bson (2.3.0)
+    builder (3.2.2)
+    connection_pool (2.1.3)
    erubis (2.7.0)
-    faraday (0.11.0)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    hashie (3.5.5)
-    i18n (0.8.1)
-    json (1.8.6)
-    jwt (1.5.6)
-    mail (2.6.4)
-      mime-types (>= 1.16, < 4)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    json (1.8.2)
+    jwt (1.4.1)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0521)
-    mini_portile2 (2.4.0)
-    minitest (5.10.1)
-    mocha (1.2.1)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (5.5.1)
+    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
      activemodel (~> 4.0)
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.7)
-      bson (~> 3.0)
+    moped (2.0.4)
+      bson (~> 2.2)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.12.1)
-    multi_xml (0.6.0)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.9.1)
-      mini_portile2 (~> 2.4.0)
-    oauth2 (1.3.1)
-      faraday (>= 0.8, < 0.12)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.4.2)
+      rack (~> 1.2)
+    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
-      rack (>= 1.0, < 3)
-    omniauth-facebook (4.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.3.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (1.5.5)
+    rack (1.5.2)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    railties (4.1.16)
-      actionpack (= 4.1.16)
-      activesupport (= 4.1.16)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (12.0.0)
-    rdoc (5.1.0)
+    rake (10.4.2)
+    rdoc (4.2.0)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (3.7.1)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (2.3.3)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
      actionpack (>= 3.0)
      activesupport (>= 3.0)
      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.13)
-    test_after_commit (1.1.0)
-      activerecord (>= 3.2)
-    thor (0.19.4)
-    thread_safe (0.3.6)
-    timecop (0.8.1)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.7)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -157,18 +158,15 @@ DEPENDENCIES
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  mongoid (~> 4.0)
-  nokogiri (= 1.9.1)
-  omniauth
+  mongoid (~> 4.0.0)
+  omniauth (~> 1.2.0)
  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
  rails!
-  rdoc (~> 5.1)
-  sqlite3 (~> 1.3.6)
-  test_after_commit
-  timecop
+  rdoc
+  sqlite3
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.17.3
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.2-stable
+++ b/gemfiles/Gemfile.rails-4.2-stable
@@ -1,22 +1,17 @@
-# frozen_string_literal: true
-
 source "https://rubygems.org"

-gemspec path: ".."
+gemspec path: '..'

-gem "rails", github: "rails/rails", branch: "4-2-stable"
-gem "omniauth"
-gem "omniauth-oauth2"
-gem "rdoc", "~> 5.1"
-gem "nokogiri", "1.9.1"
+gem "rails", github: 'rails/rails', branch: '4-2-stable'
+gem "omniauth", "~> 1.2.2"
+gem "omniauth-oauth2", "~> 1.2.0"
+gem "rdoc"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
+  gem "omniauth-openid", "~> 1.0.1"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
-  gem 'test_after_commit', require: false
 end

 platforms :jruby do
@@ -26,9 +21,9 @@ platforms :jruby do
 end

 platforms :ruby do
-  gem "sqlite3", "~> 1.3.6"
+  gem "sqlite3"
 end

 group :mongoid do
-  gem "mongoid", "~> 4.0"
+  gem "mongoid", "~> 4.0.0"
 end
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,133 +1,136 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: dc3ae21802c316e1639239d28202db7aa7fb7cac
+  revision: f12ff8ddab7b199707ec36d72bd72f206f142c8b
  branch: 4-2-stable
  specs:
-    actionmailer (4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
+    actionmailer (4.2.1)
+      actionpack (= 4.2.1)
+      actionview (= 4.2.1)
+      activejob (= 4.2.1)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.8)
-      actionview (= 4.2.8)
-      activesupport (= 4.2.8)
+    actionpack (4.2.1)
+      actionview (= 4.2.1)
+      activesupport (= 4.2.1)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.8)
-      activesupport (= 4.2.8)
+    actionview (4.2.1)
+      activesupport (= 4.2.1)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.8)
-      activesupport (= 4.2.8)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (4.2.1)
+      activesupport (= 4.2.1)
      globalid (>= 0.3.0)
-    activemodel (4.2.8)
-      activesupport (= 4.2.8)
+    activemodel (4.2.1)
+      activesupport (= 4.2.1)
      builder (~> 3.1)
-    activerecord (4.2.8)
-      activemodel (= 4.2.8)
-      activesupport (= 4.2.8)
+    activerecord (4.2.1)
+      activemodel (= 4.2.1)
+      activesupport (= 4.2.1)
      arel (~> 6.0)
-    activesupport (4.2.8)
+    activesupport (4.2.1)
      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    rails (4.2.8)
-      actionmailer (= 4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
-      activemodel (= 4.2.8)
-      activerecord (= 4.2.8)
-      activesupport (= 4.2.8)
+    rails (4.2.1)
+      actionmailer (= 4.2.1)
+      actionpack (= 4.2.1)
+      actionview (= 4.2.1)
+      activejob (= 4.2.1)
+      activemodel (= 4.2.1)
+      activerecord (= 4.2.1)
+      activesupport (= 4.2.1)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.8)
+      railties (= 4.2.1)
      sprockets-rails
-    railties (4.2.8)
-      actionpack (= 4.2.8)
-      activesupport (= 4.2.8)
+    railties (4.2.1)
+      actionpack (= 4.2.1)
+      activesupport (= 4.2.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (4.7.1)
+    devise (3.5.3)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 3.2.6, < 5)
      responders
+      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
-    arel (6.0.4)
-    bcrypt (3.1.13)
-    bson (3.2.6)
-    builder (3.2.3)
-    concurrent-ruby (1.0.5)
-    connection_pool (2.2.1)
+    arel (6.0.0)
+    bcrypt (3.1.10)
+    bson (2.3.0)
+    builder (3.2.2)
+    connection_pool (2.1.3)
    erubis (2.7.0)
-    faraday (0.11.0)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.7)
+    globalid (0.3.3)
      activesupport (>= 4.1.0)
-    hashie (3.5.5)
-    i18n (0.8.1)
-    jwt (1.5.6)
-    loofah (2.0.3)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    json (1.8.2)
+    jwt (1.4.1)
+    loofah (2.0.1)
      nokogiri (>= 1.5.9)
-    mail (2.6.4)
-      mime-types (>= 1.16, < 4)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0521)
-    mini_portile2 (2.4.0)
-    minitest (5.10.1)
-    mocha (1.2.1)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (5.5.1)
+    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
      activemodel (~> 4.0)
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.7)
-      bson (~> 3.0)
+    moped (2.0.4)
+      bson (~> 2.2)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.12.1)
-    multi_xml (0.6.0)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.9.1)
-      mini_portile2 (~> 2.4.0)
-    oauth2 (1.3.1)
-      faraday (>= 0.8, < 0.12)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (1.0.0)
+      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.6.1)
-      hashie (>= 3.4.6, < 3.6.0)
-      rack (>= 1.6.2, < 3)
-    omniauth-facebook (4.0.0)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (2.0.1)
      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
+    omniauth-oauth2 (1.2.0)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
      oauth2 (~> 1.0)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.3.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (1.6.5)
+    rack (1.6.0)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -135,34 +138,33 @@ GEM
      rack (>= 1.0)
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.8)
+    rails-dom-testing (1.0.6)
      activesupport (>= 4.2.0.beta, < 5.0)
-      nokogiri (~> 1.6)
+      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
+    rails-html-sanitizer (1.0.2)
      loofah (~> 2.0)
-    rake (12.0.0)
-    rdoc (5.1.0)
-    responders (2.4.1)
-      actionpack (>= 4.2.0, < 6.0)
-      railties (>= 4.2.0, < 6.0)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (2.1.0)
+      railties (>= 4.2.0, < 5)
    ruby-openid (2.7.0)
-    sprockets (3.7.1)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.0)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.13)
-    test_after_commit (1.1.0)
-      activerecord (>= 3.2)
-    thor (0.19.4)
-    thread_safe (0.3.6)
-    timecop (0.8.1)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.7)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -178,18 +180,15 @@ DEPENDENCIES
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  mongoid (~> 4.0)
-  nokogiri (= 1.9.1)
-  omniauth
+  mongoid (~> 4.0.0)
+  omniauth (~> 1.2.2)
  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
+  omniauth-oauth2 (~> 1.2.0)
+  omniauth-openid (~> 1.0.1)
  rails!
-  rdoc (~> 5.1)
-  sqlite3 (~> 1.3.6)
-  test_after_commit
-  timecop
+  rdoc
+  sqlite3
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.17.3
+   1.10.6
--- a/gemfiles/Gemfile.rails-5.0-stable
+++ b/gemfiles/Gemfile.rails-5.0-stable
@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-source "https://rubygems.org"
-
-gemspec path: ".."
-
-gem "rails", '~> 5.0.0'
-gem "omniauth"
-gem "omniauth-oauth2"
-gem "rdoc"
-
-gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
-
-gem "rails-controller-testing"
-
-gem "responders", "~> 2.1"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-  gem 'test_after_commit', require: false
-end
-
-platforms :ruby do
-  gem "sqlite3", "~> 1.3.6"
-end
-
-# TODO:
-# group :mongoid do
-#   gem "mongoid", "~> 4.0.0"
-# end
--- a/gemfiles/Gemfile.rails-5.0-stable.lock
+++ b/gemfiles/Gemfile.rails-5.0-stable.lock
@@ -1,194 +0,0 @@
-GIT
-  remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: dd9c0acf26aab111ebc647cd8deb99ebc6946531
-  specs:
-    activemodel-serializers-xml (1.0.1)
-      activemodel (> 5.x)
-      activesupport (> 5.x)
-      builder (~> 3.1)
-
-PATH
-  remote: ..
-  specs:
-    devise (4.7.1)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
-      responders
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (5.0.2)
-      actionpack (= 5.0.2)
-      nio4r (>= 1.2, < 3.0)
-      websocket-driver (~> 0.6.1)
-    actionmailer (5.0.2)
-      actionpack (= 5.0.2)
-      actionview (= 5.0.2)
-      activejob (= 5.0.2)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (5.0.2)
-      actionview (= 5.0.2)
-      activesupport (= 5.0.2)
-      rack (~> 2.0)
-      rack-test (~> 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.0.2)
-      activesupport (= 5.0.2)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.0.2)
-      activesupport (= 5.0.2)
-      globalid (>= 0.3.6)
-    activemodel (5.0.2)
-      activesupport (= 5.0.2)
-    activerecord (5.0.2)
-      activemodel (= 5.0.2)
-      activesupport (= 5.0.2)
-      arel (~> 7.0)
-    activesupport (5.0.2)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (~> 0.7)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    arel (7.1.4)
-    bcrypt (3.1.13)
-    builder (3.2.3)
-    concurrent-ruby (1.0.5)
-    erubis (2.7.0)
-    faraday (0.11.0)
-      multipart-post (>= 1.2, < 3)
-    globalid (0.4.0)
-      activesupport (>= 4.2.0)
-    hashie (3.5.5)
-    i18n (0.8.1)
-    jwt (1.5.6)
-    loofah (2.0.3)
-      nokogiri (>= 1.5.9)
-    mail (2.6.5)
-      mime-types (>= 1.16, < 4)
-    metaclass (0.0.4)
-    method_source (0.8.2)
-    mime-types (3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0521)
-    mini_portile2 (2.1.0)
-    minitest (5.10.1)
-    mocha (1.2.1)
-      metaclass (~> 0.0.1)
-    multi_json (1.12.1)
-    multi_xml (0.6.0)
-    multipart-post (2.0.0)
-    nio4r (2.0.0)
-    nokogiri (1.7.2)
-      mini_portile2 (~> 2.1.0)
-    oauth2 (1.3.1)
-      faraday (>= 0.8, < 0.12)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.6.1)
-      hashie (>= 3.4.6, < 3.6.0)
-      rack (>= 1.6.2, < 3)
-    omniauth-facebook (4.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    orm_adapter (0.5.0)
-    rack (2.0.2)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (5.0.2)
-      actioncable (= 5.0.2)
-      actionmailer (= 5.0.2)
-      actionpack (= 5.0.2)
-      actionview (= 5.0.2)
-      activejob (= 5.0.2)
-      activemodel (= 5.0.2)
-      activerecord (= 5.0.2)
-      activesupport (= 5.0.2)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 5.0.2)
-      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.1)
-      actionpack (~> 5.x)
-      actionview (~> 5.x)
-      activesupport (~> 5.x)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
-    railties (5.0.2)
-      actionpack (= 5.0.2)
-      activesupport (= 5.0.2)
-      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (12.0.0)
-    rdoc (5.1.0)
-    responders (2.4.0)
-      actionpack (>= 4.2.0, < 5.3)
-      railties (>= 4.2.0, < 5.3)
-    ruby-openid (2.7.0)
-    sprockets (3.7.1)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.0)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.13)
-    test_after_commit (1.1.0)
-      activerecord (>= 3.2)
-    thor (0.19.4)
-    thread_safe (0.3.6)
-    timecop (0.8.1)
-    tzinfo (1.2.3)
-      thread_safe (~> 0.1)
-    warden (1.2.7)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-    websocket-driver (0.6.5)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activemodel-serializers-xml!
-  devise!
-  mocha (~> 1.1)
-  omniauth
-  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
-  rails (~> 5.0.0)
-  rails-controller-testing
-  rdoc
-  responders (~> 2.1)
-  sqlite3 (~> 1.3.6)
-  test_after_commit
-  timecop
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.17.3
--- a/gemfiles/Gemfile.rails-5.2-stable
+++ b/gemfiles/Gemfile.rails-5.2-stable
@@ -1,27 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: ".."
-
-gem "rails", '~> 5.2'
-gem "omniauth"
-gem "omniauth-oauth2"
-gem "rdoc"
-
-gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
-
-gem "rails-controller-testing"
-
-gem "responders", "~> 2.1"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-  gem 'test_after_commit', require: false
-end
-
-platforms :ruby do
-  gem "sqlite3", "~> 1.3.6"
-end
--- a/gemfiles/Gemfile.rails-5.2-stable.lock
+++ b/gemfiles/Gemfile.rails-5.2-stable.lock
@@ -1,203 +0,0 @@
-GIT
-  remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: f744aeca2747ed3134e492249c4ee39b548efdf6
-  specs:
-    activemodel-serializers-xml (1.0.2)
-      activemodel (> 5.x)
-      activesupport (> 5.x)
-      builder (~> 3.1)
-
-PATH
-  remote: ..
-  specs:
-    devise (4.7.1)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
-      responders
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (5.2.1)
-      actionpack (= 5.2.1)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.1)
-      actionpack (= 5.2.1)
-      actionview (= 5.2.1)
-      activejob (= 5.2.1)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (5.2.1)
-      actionview (= 5.2.1)
-      activesupport (= 5.2.1)
-      rack (~> 2.0)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.1)
-      activesupport (= 5.2.1)
-      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.1)
-      activesupport (= 5.2.1)
-      globalid (>= 0.3.6)
-    activemodel (5.2.1)
-      activesupport (= 5.2.1)
-    activerecord (5.2.1)
-      activemodel (= 5.2.1)
-      activesupport (= 5.2.1)
-      arel (>= 9.0)
-    activestorage (5.2.1)
-      actionpack (= 5.2.1)
-      activerecord (= 5.2.1)
-      marcel (~> 0.3.1)
-    activesupport (5.2.1)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    arel (9.0.0)
-    bcrypt (3.1.13)
-    builder (3.2.3)
-    concurrent-ruby (1.0.5)
-    crass (1.0.4)
-    erubi (1.7.1)
-    faraday (0.12.2)
-      multipart-post (>= 1.2, < 3)
-    globalid (0.4.1)
-      activesupport (>= 4.2.0)
-    hashie (3.5.7)
-    i18n (1.1.0)
-      concurrent-ruby (~> 1.0)
-    jwt (1.5.6)
-    loofah (2.2.2)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.0)
-      mini_mime (>= 0.1.1)
-    marcel (0.3.3)
-      mimemagic (~> 0.3.2)
-    metaclass (0.0.4)
-    method_source (0.9.0)
-    mimemagic (0.3.2)
-    mini_mime (1.0.1)
-    mini_portile2 (2.3.0)
-    minitest (5.11.3)
-    mocha (1.7.0)
-      metaclass (~> 0.0.1)
-    multi_json (1.13.1)
-    multi_xml (0.6.0)
-    multipart-post (2.0.0)
-    nio4r (2.3.1)
-    nokogiri (1.8.5)
-      mini_portile2 (~> 2.3.0)
-    oauth2 (1.4.0)
-      faraday (>= 0.8, < 0.13)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.8.1)
-      hashie (>= 3.4.6, < 3.6.0)
-      rack (>= 1.6.2, < 3)
-    omniauth-facebook (5.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.5.0)
-      oauth2 (~> 1.1)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    orm_adapter (0.5.0)
-    rack (2.0.5)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rails (5.2.1)
-      actioncable (= 5.2.1)
-      actionmailer (= 5.2.1)
-      actionpack (= 5.2.1)
-      actionview (= 5.2.1)
-      activejob (= 5.2.1)
-      activemodel (= 5.2.1)
-      activerecord (= 5.2.1)
-      activestorage (= 5.2.1)
-      activesupport (= 5.2.1)
-      bundler (>= 1.3.0)
-      railties (= 5.2.1)
-      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.2)
-      actionpack (~> 5.x, >= 5.0.1)
-      actionview (~> 5.x, >= 5.0.1)
-      activesupport (~> 5.x)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.2, >= 2.2.2)
-    railties (5.2.1)
-      actionpack (= 5.2.1)
-      activesupport (= 5.2.1)
-      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.19.0, < 2.0)
-    rake (12.3.1)
-    rdoc (6.0.4)
-    responders (2.4.0)
-      actionpack (>= 4.2.0, < 5.3)
-      railties (>= 4.2.0, < 5.3)
-    ruby-openid (2.7.0)
-    sprockets (3.7.2)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.1)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.13)
-    test_after_commit (1.1.0)
-      activerecord (>= 3.2)
-    thor (0.20.0)
-    thread_safe (0.3.6)
-    timecop (0.9.1)
-    tzinfo (1.2.5)
-      thread_safe (~> 0.1)
-    warden (1.2.7)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-    websocket-driver (0.7.0)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activemodel-serializers-xml!
-  devise!
-  mocha (~> 1.1)
-  omniauth
-  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
-  rails (~> 5.2)
-  rails-controller-testing
-  rdoc
-  responders (~> 2.1)
-  sqlite3 (~> 1.3.6)
-  test_after_commit
-  timecop
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.17.3
--- a/gemfiles/Gemfile.rails-6.0-stable
+++ b/gemfiles/Gemfile.rails-6.0-stable
@@ -1,27 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: ".."
-
-gem "rails", '~> 6.0.0'
-gem "omniauth"
-gem "omniauth-oauth2"
-gem "rdoc"
-
-gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
-
-gem "rails-controller-testing"
-
-gem "responders", "~> 3.0"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid"
-  gem "timecop"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-  gem 'test_after_commit', require: false
-end
-
-platforms :ruby do
-  gem "sqlite3", "~> 1.4"
-end
--- a/gemfiles/Gemfile.rails-6.0-stable.lock
+++ b/gemfiles/Gemfile.rails-6.0-stable.lock
@@ -1,219 +0,0 @@
-GIT
-  remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: 93689638c28525acc65afb638fce866826532641
-  specs:
-    activemodel-serializers-xml (1.0.2)
-      activemodel (>= 5.0.0.a)
-      activesupport (>= 5.0.0.a)
-      builder (~> 3.1)
-
-PATH
-  remote: ..
-  specs:
-    devise (4.7.1)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
-      responders
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (6.0.0)
-      actionpack (= 6.0.0)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.0)
-      actionpack (= 6.0.0)
-      activejob (= 6.0.0)
-      activerecord (= 6.0.0)
-      activestorage (= 6.0.0)
-      activesupport (= 6.0.0)
-      mail (>= 2.7.1)
-    actionmailer (6.0.0)
-      actionpack (= 6.0.0)
-      actionview (= 6.0.0)
-      activejob (= 6.0.0)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (6.0.0)
-      actionview (= 6.0.0)
-      activesupport (= 6.0.0)
-      rack (~> 2.0)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.0)
-      actionpack (= 6.0.0)
-      activerecord (= 6.0.0)
-      activestorage (= 6.0.0)
-      activesupport (= 6.0.0)
-      nokogiri (>= 1.8.5)
-    actionview (6.0.0)
-      activesupport (= 6.0.0)
-      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.0)
-      activesupport (= 6.0.0)
-      globalid (>= 0.3.6)
-    activemodel (6.0.0)
-      activesupport (= 6.0.0)
-    activerecord (6.0.0)
-      activemodel (= 6.0.0)
-      activesupport (= 6.0.0)
-    activestorage (6.0.0)
-      actionpack (= 6.0.0)
-      activejob (= 6.0.0)
-      activerecord (= 6.0.0)
-      marcel (~> 0.3.1)
-    activesupport (6.0.0)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.1, >= 2.1.8)
-    bcrypt (3.1.13)
-    builder (3.2.3)
-    concurrent-ruby (1.1.5)
-    crass (1.0.4)
-    erubi (1.8.0)
-    faraday (0.15.4)
-      multipart-post (>= 1.2, < 3)
-    globalid (0.4.2)
-      activesupport (>= 4.2.0)
-    hashie (3.6.0)
-    i18n (1.6.0)
-      concurrent-ruby (~> 1.0)
-    jwt (2.2.1)
-    loofah (2.2.3)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.1)
-      mini_mime (>= 0.1.1)
-    marcel (0.3.3)
-      mimemagic (~> 0.3.2)
-    metaclass (0.0.4)
-    method_source (0.9.2)
-    mimemagic (0.3.3)
-    mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
-    minitest (5.11.3)
-    mocha (1.9.0)
-      metaclass (~> 0.0.1)
-    multi_json (1.13.1)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    nio4r (2.4.0)
-    nokogiri (1.10.4)
-      mini_portile2 (~> 2.4.0)
-    oauth2 (1.4.1)
-      faraday (>= 0.8, < 0.16.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.9.0)
-      hashie (>= 3.4.6, < 3.7.0)
-      rack (>= 1.6.2, < 3)
-    omniauth-facebook (5.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.6.0)
-      oauth2 (~> 1.1)
-      omniauth (~> 1.9)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    orm_adapter (0.5.0)
-    rack (2.0.7)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rails (6.0.0)
-      actioncable (= 6.0.0)
-      actionmailbox (= 6.0.0)
-      actionmailer (= 6.0.0)
-      actionpack (= 6.0.0)
-      actiontext (= 6.0.0)
-      actionview (= 6.0.0)
-      activejob (= 6.0.0)
-      activemodel (= 6.0.0)
-      activerecord (= 6.0.0)
-      activestorage (= 6.0.0)
-      activesupport (= 6.0.0)
-      bundler (>= 1.3.0)
-      railties (= 6.0.0)
-      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (1.0.4)
-      actionpack (>= 5.0.1.x)
-      actionview (>= 5.0.1.x)
-      activesupport (>= 5.0.1.x)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.2.0)
-      loofah (~> 2.2, >= 2.2.2)
-    railties (6.0.0)
-      actionpack (= 6.0.0)
-      activesupport (= 6.0.0)
-      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.20.3, < 2.0)
-    rake (12.3.3)
-    rdoc (6.1.1)
-    responders (3.0.0)
-      actionpack (>= 5.0)
-      railties (>= 5.0)
-    ruby-openid (2.7.0)
-    sprockets (3.7.2)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.1)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.4.1)
-    test_after_commit (1.1.0)
-      activerecord (>= 3.2)
-    thor (0.20.3)
-    thread_safe (0.3.6)
-    timecop (0.9.1)
-    tzinfo (1.2.5)
-      thread_safe (~> 0.1)
-    warden (1.2.8)
-      rack (>= 2.0.6)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-    websocket-driver (0.7.1)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.4)
-    zeitwerk (2.1.9)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activemodel-serializers-xml!
-  devise!
-  mocha (~> 1.1)
-  omniauth
-  omniauth-facebook
-  omniauth-oauth2
-  omniauth-openid
-  rails (~> 6.0.0)
-  rails-controller-testing
-  rdoc
-  responders (~> 3.0)
-  sqlite3 (~> 1.4)
-  test_after_commit
-  timecop
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.17.3
--- a/guides/bug_report_templates/integration_test.rb
+++ b/guides/bug_report_templates/integration_test.rb
@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-
-begin
-  require 'bundler/inline'
-rescue LoadError => e
-  $stderr.puts 'Bundler version 1.10 or later is required. Please update your Bundler'
-  raise e
-end
-
-gemfile(true) do
-  source 'https://rubygems.org'
-  # Activate the gem you are reporting the issue against.
-  gem 'rails', '~> 4.2.0'
-  gem 'devise', '~> 4.0'
-  gem 'sqlite3'
-  gem 'byebug'
-end
-
-require 'rack/test'
-require 'action_controller/railtie'
-require 'active_record'
-require 'devise/rails/routes'
-require 'devise/rails/warden_compat'
-
-ActiveRecord::Base.establish_connection( adapter: :sqlite3, database:  ':memory:')
-
-class DeviseCreateUsers < ActiveRecord::Migration
-  def change
-    create_table(:users) do |t|
-      t.string :email,              null: false
-      t.string :encrypted_password, null: true
-      t.timestamps null: false
-    end
-
-  end
-end
-
-Devise.setup do |config|
-  require 'devise/orm/active_record'
-  config.secret_key = 'secret_key_base'
-end
-
-class TestApp < Rails::Application
-  config.root = File.dirname(__FILE__)
-  config.session_store :cookie_store, key: 'cookie_store_key'
-  secrets.secret_token    = 'secret_token'
-  secrets.secret_key_base = 'secret_key_base'
-  config.eager_load = false
-
-  config.middleware.use Warden::Manager do |config|
-    Devise.warden_config = config
-  end
-
-  config.logger = Logger.new($stdout)
-  Rails.logger  = config.logger
-
-end
-
-Rails.application.initialize!
-
-DeviseCreateUsers.migrate(:up)
-
-class User < ActiveRecord::Base
-  devise :database_authenticatable
-end
-
-Rails.application.routes.draw do
-  devise_for :users
-
-  get '/' => 'test#index'
-end
-
-class ApplicationController < ActionController::Base
-end
-
-class TestController < ApplicationController
-  include Rails.application.routes.url_helpers
-
-  before_action :authenticate_user!
-
-  def index
-    render plain: 'Home'
-  end
-end
-
-require 'minitest/autorun'
-
-class BugTest < ActionDispatch::IntegrationTest
-  include Rack::Test::Methods
-  include Warden::Test::Helpers
-
-  def test_returns_success
-    Warden.test_mode!
-
-    login_as User.create!(email: 'test@test.com', password: 'test123456', password_confirmation: 'test123456')
-
-    get '/'
-    assert last_response.ok?
-  end
-
-  private
-
-  def app
-    Rails.application
-  end
-end
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'rails'
 require 'active_support/core_ext/numeric/time'
 require 'active_support/dependencies'
@@ -14,19 +12,19 @@ module Devise
  autoload :FailureApp,         'devise/failure_app'
  autoload :OmniAuth,           'devise/omniauth'
  autoload :ParameterFilter,    'devise/parameter_filter'
+  autoload :BaseSanitizer,      'devise/parameter_sanitizer'
  autoload :ParameterSanitizer, 'devise/parameter_sanitizer'
  autoload :TestHelpers,        'devise/test_helpers'
  autoload :TimeInflector,      'devise/time_inflector'
  autoload :TokenGenerator,     'devise/token_generator'
-  autoload :SecretKeyFinder,    'devise/secret_key_finder'

  module Controllers
-    autoload :Helpers,        'devise/controllers/helpers'
-    autoload :Rememberable,   'devise/controllers/rememberable'
-    autoload :ScopedViews,    'devise/controllers/scoped_views'
-    autoload :SignInOut,      'devise/controllers/sign_in_out'
-    autoload :StoreLocation,  'devise/controllers/store_location'
-    autoload :UrlHelpers,     'devise/controllers/url_helpers'
+    autoload :Helpers, 'devise/controllers/helpers'
+    autoload :Rememberable, 'devise/controllers/rememberable'
+    autoload :ScopedViews, 'devise/controllers/scoped_views'
+    autoload :SignInOut, 'devise/controllers/sign_in_out'
+    autoload :StoreLocation, 'devise/controllers/store_location'
+    autoload :UrlHelpers, 'devise/controllers/url_helpers'
  end

  module Hooks
@@ -38,22 +36,17 @@ module Devise
  end

  module Strategies
-    autoload :Base,            'devise/strategies/base'
+    autoload :Base, 'devise/strategies/base'
    autoload :Authenticatable, 'devise/strategies/authenticatable'
  end

-  module Test
-    autoload :ControllerHelpers,  'devise/test/controller_helpers'
-    autoload :IntegrationHelpers, 'devise/test/integration_helpers'
-  end
-
  # Constants which holds devise configuration for extensions. Those should
  # not be modified by the "end user" (this is why they are constants).
  ALL         = []
-  CONTROLLERS = {}
-  ROUTES      = {}
-  STRATEGIES  = {}
-  URL_HELPERS = {}
+  CONTROLLERS = ActiveSupport::OrderedHash.new
+  ROUTES      = ActiveSupport::OrderedHash.new
+  STRATEGIES  = ActiveSupport::OrderedHash.new
+  URL_HELPERS = ActiveSupport::OrderedHash.new

  # Strategies that do not require user input.
  NO_INPUT = []
@@ -69,9 +62,9 @@ module Devise
  mattr_accessor :rememberable_options
  @@rememberable_options = {}

-  # The number of times to hash the password.
+  # The number of times to encrypt password.
  mattr_accessor :stretches
-  @@stretches = 12
+  @@stretches = 10

  # The default key used when authenticating over http auth.
  mattr_accessor :http_authentication_key
@@ -91,7 +84,7 @@ module Devise

  # Keys that should have whitespace stripped.
  mattr_accessor :strip_whitespace_keys
-  @@strip_whitespace_keys = [:email]
+  @@strip_whitespace_keys = []

  # If http authentication is enabled by default.
  mattr_accessor :http_authenticatable
@@ -109,11 +102,11 @@ module Devise
  mattr_accessor :http_authentication_realm
  @@http_authentication_realm = "Application"

-  # Email regex used to validate email formats. It asserts that there are no
-  # @ symbols or whitespaces in either the localpart or the domain, and that
-  # there is a single @ symbol separating the localpart and the domain.
+  # Email regex used to validate email formats. It simply asserts that
+  # an one (and only one) @ exists in the given string. This is mainly
+  # to give user feedback and not to assert the e-mail validity.
  mattr_accessor :email_regexp
-  @@email_regexp = /\A[^@\s]+@[^@\s]+\z/
+  @@email_regexp = /\A[^@\s]+@([^@\s]+\.)+[^@\W]+\z/

  # Range validation for password length
  mattr_accessor :password_length
@@ -123,6 +116,7 @@ module Devise
  mattr_accessor :remember_for
  @@remember_for = 2.weeks

+  # TODO: extend_remember_period is no longer used
  # If true, extends the user's remember period when remembered via cookie.
  mattr_accessor :extend_remember_period
  @@extend_remember_period = false
@@ -145,22 +139,19 @@ module Devise
  @@confirmation_keys = [:email]

  # Defines if email should be reconfirmable.
+  # False by default for backwards compatibility.
  mattr_accessor :reconfirmable
-  @@reconfirmable = true
+  @@reconfirmable = false

  # Time interval to timeout the user session without activity.
  mattr_accessor :timeout_in
  @@timeout_in = 30.minutes

-  # Used to hash the password. Please generate one with rails secret.
+  # Used to encrypt password. Please generate one with rake secret.
  mattr_accessor :pepper
  @@pepper = nil

-  # Used to send notification to the original user email when their email is changed.
-  mattr_accessor :send_email_changed_notification
-  @@send_email_changed_notification = false
-
-  # Used to enable sending notification to user when their password is changed.
+  # Used to enable sending notification to user when their password is changed
  mattr_accessor :send_password_change_notification
  @@send_password_change_notification = false

@@ -213,7 +204,7 @@ module Devise

  # Skip session storage for the following strategies
  mattr_accessor :skip_session_storage
-  @@skip_session_storage = [:http_auth]
+  @@skip_session_storage = []

  # Which formats should be treated as navigational.
  mattr_accessor :navigational_formats
@@ -225,7 +216,7 @@ module Devise

  # The default method used while signing out
  mattr_accessor :sign_out_via
-  @@sign_out_via = :delete
+  @@sign_out_via = :get

  # The parent controller all Devise controllers inherits from.
  # Defaults to ApplicationController. This should be set early
@@ -254,22 +245,15 @@ module Devise
  mattr_accessor :clean_up_csrf_token_on_authentication
  @@clean_up_csrf_token_on_authentication = true

-  # When false, Devise will not attempt to reload routes on eager load.
-  # This can reduce the time taken to boot the app but if your application
-  # requires the Devise mappings to be loaded during boot time the application
-  # won't boot properly.
-  mattr_accessor :reload_routes
-  @@reload_routes = true
-
  # PRIVATE CONFIGURATION

  # Store scopes mappings.
  mattr_reader :mappings
-  @@mappings = {}
+  @@mappings = ActiveSupport::OrderedHash.new

  # OmniAuth configurations.
  mattr_reader :omniauth_configs
-  @@omniauth_configs = {}
+  @@omniauth_configs = ActiveSupport::OrderedHash.new

  # Define a set of modules that are called when a mapping is added.
  mattr_reader :helpers
@@ -293,30 +277,14 @@ module Devise
  mattr_accessor :token_generator
  @@token_generator = nil

-  # When set to false, changing a password does not automatically sign in a user
-  mattr_accessor :sign_in_after_change_password
-  @@sign_in_after_change_password = true
-
-  def self.rails51? # :nodoc:
-    Rails.gem_version >= Gem::Version.new("5.1.x")
-  end
-
-  def self.activerecord51? # :nodoc:
-    defined?(ActiveRecord) && ActiveRecord.gem_version >= Gem::Version.new("5.1.x")
-  end
-
-  def self.rails6_and_up?
-    Rails.gem_version >= Gem::Version.new("6.0.x")
-  end
-
-  # Default way to set up Devise. Run rails generate devise_install to create
+  # Default way to setup Devise. Run rails generate devise_install to create
  # a fresh initializer with all configuration values.
  def self.setup
    yield self
  end

  class Getter
-    def initialize(name)
+    def initialize name
      @name = name
    end

@@ -326,8 +294,12 @@ module Devise
  end

  def self.ref(arg)
-    ActiveSupport::Dependencies.reference(arg)
-    Getter.new(arg)
+    if defined?(ActiveSupport::Dependencies::ClassCache)
+      ActiveSupport::Dependencies::reference(arg)
+      Getter.new(arg)
+    else
+      ActiveSupport::Dependencies.ref(arg)
+    end
  end

  def self.available_router_name
@@ -448,6 +420,7 @@ module Devise
  #   config.omniauth :github, APP_ID, APP_SECRET
  #
  def self.omniauth(provider, *args)
+    @@helpers << Devise::OmniAuth::UrlHelpers
    config = Devise::OmniAuth::Config.new(provider, args)
    @@omniauth_configs[config.strategy_name.to_sym] = config
  end
@@ -485,7 +458,10 @@ module Devise
          mapping.to.serialize_into_session(record)
        end

-        warden_config.serialize_from_session(mapping.name) do |args|
+        warden_config.serialize_from_session(mapping.name) do |key|
+          # Previous versions contained an additional entry at the beginning of
+          # key with the record's class name.
+          args = key[-2, 2]
          mapping.to.serialize_from_session(*args)
        end
      end
--- a/lib/devise/controllers/helpers.rb
+++ b/lib/devise/controllers/helpers.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Controllers
    # Those helpers are convenience methods added to ApplicationController.
@@ -32,8 +30,8 @@ module Devise
        #     current_bloggers       # Currently signed in user and admin
        #
        #   Use:
-        #     before_action :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
-        #     before_action ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
+        #     before_filter :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
+        #     before_filter ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
        #     current_blogger :user                             # Preferably returns a User if one is signed in
        #
        def devise_group(group_name, opts={})
@@ -86,7 +84,7 @@ module Devise
      end

      # Define authentication filters and accessor helpers based on mappings.
-      # These filters should be used inside the controllers as before_actions,
+      # These filters should be used inside the controllers as before_filters,
      # so you can control the scope of the user who should be signed in to
      # access that specific controller/action.
      # Example:
@@ -106,8 +104,8 @@ module Devise
      #     admin_session       # Session data available only to the admin scope
      #
      #   Use:
-      #     before_action :authenticate_user!  # Tell devise to use :user map
-      #     before_action :authenticate_admin! # Tell devise to use :admin map
+      #     before_filter :authenticate_user!  # Tell devise to use :user map
+      #     before_filter :authenticate_admin! # Tell devise to use :admin map
      #
      def self.define_helpers(mapping) #:nodoc:
        mapping = mapping.name
@@ -140,23 +138,27 @@ module Devise

      # The main accessor for the warden proxy instance
      def warden
-        request.env['warden'] or raise MissingWarden
+        request.env['warden']
      end

      # Return true if it's a devise_controller. false to all controllers unless
      # the controllers defined inside devise. Useful if you want to apply a before
      # filter to all controllers, except the ones in devise:
      #
-      #   before_action :my_filter, unless: :devise_controller?
+      #   before_filter :my_filter, unless: :devise_controller?
      def devise_controller?
        is_a?(::DeviseController)
      end

-      # Set up a param sanitizer to filter parameters using strong_parameters. See
+      # Setup a param sanitizer to filter parameters using strong_parameters. See
      # lib/devise/parameter_sanitizer.rb for more info. Override this
      # method in your application controller to use your own parameter sanitizer.
      def devise_parameter_sanitizer
-        @devise_parameter_sanitizer ||= Devise::ParameterSanitizer.new(resource_class, resource_name, params)
+        @devise_parameter_sanitizer ||= if defined?(ActionController::StrongParameters)
+          Devise::ParameterSanitizer.new(resource_class, resource_name, params)
+        else
+          Devise::BaseSanitizer.new(resource_class, resource_name, params)
+        end
      end

      # Tell warden that params authentication is allowed for that specific page.
@@ -268,26 +270,21 @@ module Devise
      # Check if flash messages should be emitted. Default is to do it on
      # navigational formats
      def is_flashing_format?
-        request.respond_to?(:flash) && is_navigational_format?
+        is_navigational_format?
      end

      private

+      def expire_session_data_after_sign_in!
+        ActiveSupport::Deprecation.warn "expire_session_data_after_sign_in! is deprecated " \
+          "in favor of expire_data_after_sign_in!"
+        expire_data_after_sign_in!
+      end
+
      def expire_data_after_sign_out!
        Devise.mappings.each { |_,m| instance_variable_set("@current_#{m.name}", nil) }
        super
      end
    end
  end
-
-  class MissingWarden < StandardError
-    def initialize
-      super "Devise could not find the `Warden::Proxy` instance on your request environment.\n" + \
-        "Make sure that your application is loading Devise and Warden as expected and that " + \
-        "the `Warden::Manager` middleware is present in your middleware stack.\n" + \
-        "If you are seeing this on one of your tests, ensure that your tests are either " + \
-        "executing the Rails middleware stack or that your tests are using the `Devise::Test::ControllerHelpers` " + \
-        "module to inject the `request.env['warden']` object for you."
-    end
-  end
 end
--- a/lib/devise/controllers/rememberable.rb
+++ b/lib/devise/controllers/rememberable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Controllers
    # A module that may be optionally included in a controller in order
@@ -14,13 +12,13 @@ module Devise
      def remember_me_is_active?(resource)
        return false unless resource.respond_to?(:remember_me)
        scope = Devise::Mapping.find_scope!(resource)
-        _, token, generated_at = cookies.signed[remember_key(resource, scope)]
-        resource.remember_me?(token, generated_at)
+        cookie = cookies.signed[remember_key(resource, scope)]
+        resource.class.serialized_in_cookie?(resource, *cookie)
      end

      # Remembers the given resource by setting up a cookie
      def remember_me(resource)
-        return if request.env["devise.skip_storage"]
+        return if env["devise.skip_storage"]
        scope = Devise::Mapping.find_scope!(resource)
        resource.remember_me!
        cookies.signed[remember_key(resource, scope)] = remember_cookie_values(resource)
--- a/lib/devise/controllers/scoped_views.rb
+++ b/lib/devise/controllers/scoped_views.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Controllers
    module ScopedViews
--- a/lib/devise/controllers/sign_in_out.rb
+++ b/lib/devise/controllers/sign_in_out.rb
@@ -1,15 +1,10 @@
-# frozen_string_literal: true
-
 module Devise
  module Controllers
    # Provide sign in and sign out functionality.
    # Included by default in all controllers.
    module SignInOut
      # Return true if the given scope is signed in session. If no scope given, return
-      # true if any scope is signed in. This will run authentication hooks, which may
-      # cause exceptions to be thrown from this method; if you simply want to check
-      # if a scope has already previously been authenticated without running
-      # authentication hooks, you can directly call `warden.authenticated?(scope: scope)`
+      # true if any scope is signed in. Does not run authentication hooks.
      def signed_in?(scope=nil)
        [scope || Devise.mappings.keys].flatten.any? do |_scope|
          warden.authenticate?(scope: _scope)
@@ -17,18 +12,20 @@ module Devise
      end

      # Sign in a user that already was authenticated. This helper is useful for logging
-      # users in after sign up. All options given to sign_in is passed forward
-      # to the set_user method in warden.
-      # If you are using a custom warden strategy and the timeoutable module, you have to
-      # set `env["devise.skip_timeout"] = true` in the request to use this method, like we do
-      # in the sessions controller: https://github.com/plataformatec/devise/blob/master/app/controllers/devise/sessions_controller.rb#L7
+      # users in after sign up.
+      #
+      # All options given to sign_in is passed forward to the set_user method in warden.
+      # The only exception is the :bypass option, which bypass warden callbacks and stores
+      # the user straight in session. This option is useful in cases the user is already
+      # signed in, but we want to refresh the credentials in session.
      #
      # Examples:
      #
      #   sign_in :user, @user                      # sign_in(scope, resource)
      #   sign_in @user                             # sign_in(resource)
-      #   sign_in @user, event: :authentication     # sign_in(resource, options)
-      #   sign_in @user, store: false               # sign_in(resource, options)
+      #   sign_in @user, event: :authentication  # sign_in(resource, options)
+      #   sign_in @user, store: false            # sign_in(resource, options)
+      #   sign_in @user, bypass: true            # sign_in(resource, options)
      #
      def sign_in(resource_or_scope, *args)
        options  = args.extract_options!
@@ -38,13 +35,6 @@ module Devise
        expire_data_after_sign_in!

        if options[:bypass]
-          ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc, caller)
-          [Devise] bypass option is deprecated and it will be removed in future version of Devise.
-          Please use bypass_sign_in method instead.
-          Example:
-
-            bypass_sign_in(user)
-          DEPRECATION
          warden.session_serializer.store(resource, scope)
        elsif warden.user(scope) == resource && !options.delete(:force)
          # Do nothing. User already signed in and we are not forcing it.
@@ -54,20 +44,6 @@ module Devise
        end
      end

-      # Sign in a user bypassing the warden callbacks and stores the user
-      # straight in session. This option is useful in cases the user is already
-      # signed in, but we want to refresh the credentials in session.
-      #
-      # Examples:
-      #
-      #   bypass_sign_in @user, scope: :user
-      #   bypass_sign_in @user
-      def bypass_sign_in(resource, scope: nil)
-        scope ||= Devise::Mapping.find_scope!(resource)
-        expire_data_after_sign_in!
-        warden.session_serializer.store(resource, scope)
-      end
-
      # Sign out a given user or scope. This helper is useful for signing out a user
      # after deleting accounts. Returns true if there was a logout and false if there
      # is no user logged in on the referred scope
@@ -82,6 +58,7 @@ module Devise
        scope = Devise::Mapping.find_scope!(resource_or_scope)
        user = warden.user(scope: scope, run_callbacks: false) # If there is no user

+        warden.raw_session.inspect # Without this inspect here. The session does not clear.
        warden.logout(scope)
        warden.clear_strategies_cache!(scope: scope)
        instance_variable_set(:"@current_#{scope}", nil)
--- a/lib/devise/controllers/store_location.rb
+++ b/lib/devise/controllers/store_location.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require "uri"

 module Devise
@@ -31,13 +29,16 @@ module Devise
      # Example:
      #
      #   store_location_for(:user, dashboard_path)
-      #   redirect_to user_facebook_omniauth_authorize_path
+      #   redirect_to user_omniauth_authorize_path(:facebook)
      #
      def store_location_for(resource_or_scope, location)
        session_key = stored_location_key_for(resource_or_scope)
-        
-        path = extract_path_from_location(location)
-        session[session_key] = path if path
+        uri = parse_uri(location)
+        if uri
+          path = [uri.path.sub(/\A\/+/, '/'), uri.query].compact.join('?')
+          path = [path, uri.fragment].compact.join('#')
+          session[session_key] = path
+        end
      end

      private
@@ -52,25 +53,6 @@ module Devise
        scope = Devise::Mapping.find_scope!(resource_or_scope)
        "#{scope}_return_to"
      end
-
-      def extract_path_from_location(location)
-        uri = parse_uri(location)
-
-        if uri 
-          path = remove_domain_from_uri(uri)
-          path = add_fragment_back_to_path(uri, path)
-
-          path
-        end
-      end
-
-      def remove_domain_from_uri(uri)
-        [uri.path.sub(/\A\/+/, '/'), uri.query].compact.join('?')
-      end
-
-      def add_fragment_back_to_path(uri, path)
-        [path, uri.fragment].compact.join('#')
-      end
    end
  end
 end
--- a/lib/devise/controllers/url_helpers.rb
+++ b/lib/devise/controllers/url_helpers.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Controllers
    # Create url helpers to be used with resource/scope configuration. Acts as
--- a/lib/devise/delegator.rb
+++ b/lib/devise/delegator.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  # Checks the scope in the given environment and returns the associated failure app.
  class Delegator
--- a/lib/devise/encryptor.rb
+++ b/lib/devise/encryptor.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'bcrypt'

 module Devise
@@ -11,14 +9,14 @@ module Devise
      ::BCrypt::Password.create(password, cost: klass.stretches).to_s
    end

-    def self.compare(klass, hashed_password, password)
-      return false if hashed_password.blank?
-      bcrypt   = ::BCrypt::Password.new(hashed_password)
+    def self.compare(klass, encrypted_password, password)
+      return false if encrypted_password.blank?
+      bcrypt   = ::BCrypt::Password.new(encrypted_password)
      if klass.pepper.present?
        password = "#{password}#{klass.pepper}"
      end
      password = ::BCrypt::Engine.hash_secret(password, bcrypt.salt)
-      Devise.secure_compare(password, hashed_password)
+      Devise.secure_compare(password, encrypted_password)
    end
  end
 end
--- a/lib/devise/failure_app.rb
+++ b/lib/devise/failure_app.rb
@@ -1,13 +1,12 @@
-# frozen_string_literal: true
-
 require "action_controller/metal"

 module Devise
  # Failure application that will be called every time :warden is thrown from
-  # any strategy or hook. It is responsible for redirecting the user to the sign
-  # in page based on current scope and mapping. If no scope is given, it
-  # redirects to the default_url.
+  # any strategy or hook. Responsible for redirect the user to the sign in
+  # page based on current scope and mapping. If no scope is given, redirect
+  # to the default_url.
  class FailureApp < ActionController::Metal
+    include ActionController::RackDelegation
    include ActionController::UrlFor
    include ActionController::Redirecting

@@ -23,7 +22,7 @@ module Devise
      @respond.call(env)
    end

-    # Try retrieving the URL options from the parent controller (usually
+    # Try retrieving the URL options from the parent controller (usually 
    # ApplicationController). Instance methods are not supported at the moment,
    # so only the class-level attribute is used.
    def self.default_url_options(*args)
@@ -52,27 +51,20 @@ module Devise
    end

    def recall
-      header_info = if relative_url_root?
-        base_path = Pathname.new(relative_url_root)
+      config = Rails.application.config
+
+      if config.try(:relative_url_root)
+        base_path = Pathname.new(config.relative_url_root)
        full_path = Pathname.new(attempted_path)

-        { "SCRIPT_NAME" => relative_url_root,
-          "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
+        env["SCRIPT_NAME"] = config.relative_url_root
+        env["PATH_INFO"] = '/' + full_path.relative_path_from(base_path).to_s
      else
-        { "PATH_INFO" => attempted_path }
-      end
-
-      header_info.each do | var, value|
-        if request.respond_to?(:set_header)
-          request.set_header(var, value)
-        else
-          request.env[var]  = value
-        end
+        env["PATH_INFO"]  = attempted_path
      end

      flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
-      # self.response = recall_app(warden_options[:recall]).call(env)
-      self.response = recall_app(warden_options[:recall]).call(request.env)
+      self.response = recall_app(warden_options[:recall]).call(env)
    end

    def redirect
@@ -103,7 +95,7 @@ module Devise
        options[:scope] = "devise.failure"
        options[:default] = [message]
        auth_keys = scope_class.authentication_keys
-        keys = (auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys).map { |key| scope_class.human_attribute_name(key) }
+        keys = auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
        options[:authentication_keys] = keys.join(I18n.translate(:"support.array.words_connector"))
        options = i18n_options(options)

@@ -135,29 +127,23 @@ module Devise

    def scope_url
      opts  = {}
-
-      # Initialize script_name with nil to prevent infinite loops in
-      # authenticated mounted engines in rails 4.2 and 5.0
-      opts[:script_name] = nil
-
      route = route(scope)
-
      opts[:format] = request_format unless skip_format?

+      config = Rails.application.config
+
+      # Rails 4.2 goes into an infinite loop if opts[:script_name] is unset
+      if (Rails::VERSION::MAJOR >= 4) && (Rails::VERSION::MINOR >= 2)
+        opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))
+      else
+        if config.respond_to?(:relative_url_root) && config.relative_url_root.present?
+          opts[:script_name] = config.relative_url_root
+        end
+      end
+
      router_name = Devise.mappings[scope].router_name || Devise.available_router_name
      context = send(router_name)

-      if relative_url_root?
-        opts[:script_name] = relative_url_root
-
-      # We need to add the rootpath to `script_name` manually for applications that use a Rails
-      # version lower than 5.1. Otherwise, it is going to generate a wrong path for Engines
-      # that use Devise. Remove it when the support of Rails 5.0 is droped.
-      elsif root_path_defined?(context) && !rails_51_and_up?
-        rootpath = context.routes.url_helpers.root_path
-        opts[:script_name] = rootpath.chomp('/') if rootpath.length > 1
-      end
-
      if context.respond_to?(route)
        context.send(route, opts)
      elsif respond_to?(:root_url)
@@ -171,12 +157,12 @@ module Devise
      %w(html */*).include? request_format.to_s
    end

-    # Choose whether we should respond in an HTTP authentication fashion,
+    # Choose whether we should respond in a http authentication fashion,
    # including 401 and optional headers.
    #
-    # This method allows the user to explicitly disable HTTP authentication
-    # on AJAX requests in case they want to redirect on failures instead of
-    # handling the errors on their own. This is useful in case your AJAX API
+    # This method allows the user to explicitly disable http authentication
+    # on ajax requests in case they want to redirect on failures instead of
+    # handling the errors on their own. This is useful in case your ajax API
    # is the same as your public API and uses a format like JSON (so you
    # cannot mark JSON as a navigational format).
    def http_auth?
@@ -187,7 +173,7 @@ module Devise
      end
    end

-    # It doesn't make sense to send authenticate headers in AJAX requests
+    # It does not make sense to send authenticate headers in ajax requests
    # or if the user disabled them.
    def http_auth_header?
      scope_class.http_authenticatable && !request.xhr?
@@ -213,11 +199,11 @@ module Devise
    end

    def warden
-      request.respond_to?(:get_header) ? request.get_header("warden") : request.env["warden"]
+      env['warden']
    end

    def warden_options
-      request.respond_to?(:get_header) ? request.get_header("warden.options") : request.env["warden.options"]
+      env['warden.options']
    end

    def warden_message
@@ -236,10 +222,10 @@ module Devise
      warden_options[:attempted_path]
    end

-    # Stores requested URI to redirect the user after signing in. We can't use
-    # the scoped session provided by warden here, since the user is not
-    # authenticated yet, but we still need to store the URI based on scope, so
-    # different scopes would never use the same URI to redirect.
+    # Stores requested uri to redirect the user after signing in. We cannot use
+    # scoped session provided by warden here, since the user is not authenticated
+    # yet, but we still need to store the uri based on scope, so different scopes
+    # would never use the same uri to redirect.
    def store_location!
      store_location_for(scope, attempted_path) if request.get? && !http_auth?
    end
@@ -251,35 +237,11 @@ module Devise
    # Check if flash messages should be emitted. Default is to do it on
    # navigational formats
    def is_flashing_format?
-      request.respond_to?(:flash) && is_navigational_format?
+      is_navigational_format?
    end

    def request_format
      @request_format ||= request.format.try(:ref)
    end
-
-    def relative_url_root
-      @relative_url_root ||= begin
-        config = Rails.application.config
-
-        config.try(:relative_url_root) || config.action_controller.try(:relative_url_root)
-      end
-    end
-
-    def relative_url_root?
-      relative_url_root.present?
-    end
-
-    ActiveSupport.run_load_hooks(:devise_failure_app, self)
-
-    private
-
-    def root_path_defined?(context)
-      defined?(context.routes) && context.routes.url_helpers.respond_to?(:root_path)
-    end
-
-    def rails_51_and_up?
-      Rails.gem_version >= Gem::Version.new("5.1")
-    end
  end
 end
--- a/lib/devise/hooks/activatable.rb
+++ b/lib/devise/hooks/activatable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 # Deny user access whenever their account is not active yet.
 # We need this as hook to validate the user activity on each request
 # and in case the user is using other strategies beside Devise ones.
--- a/lib/devise/hooks/csrf_cleaner.rb
+++ b/lib/devise/hooks/csrf_cleaner.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 Warden::Manager.after_authentication do |record, warden, options|
  clean_up_for_winning_strategy = !warden.winning_strategy.respond_to?(:clean_up_csrf?) ||
    warden.winning_strategy.clean_up_csrf?
--- a/lib/devise/hooks/forgetable.rb
+++ b/lib/devise/hooks/forgetable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 # Before logout hook to forget the user in the given scope, if it responds
 # to forget_me! Also clear remember token to ensure the user won't be
 # remembered again. Notice that we forget the user unless the record is not persisted.
--- a/lib/devise/hooks/lockable.rb
+++ b/lib/devise/hooks/lockable.rb
@@ -1,12 +1,7 @@
-# frozen_string_literal: true
-
 # After each sign in, if resource responds to failed_attempts, sets it to 0
 # This is only triggered when the user is explicitly set (with set_user)
 Warden::Manager.after_set_user except: :fetch do |record, warden, options|
  if record.respond_to?(:failed_attempts) && warden.authenticated?(options[:scope])
-    unless record.failed_attempts.to_i.zero?
-      record.failed_attempts = 0
-      record.save(validate: false)
-    end
+    record.update_attribute(:failed_attempts, 0) unless record.failed_attempts.to_i.zero?
  end
 end
--- a/lib/devise/hooks/proxy.rb
+++ b/lib/devise/hooks/proxy.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Hooks
    # A small warden proxy so we can remember, forget and
@@ -9,7 +7,7 @@ module Devise
      include Devise::Controllers::SignInOut

      attr_reader :warden
-      delegate :cookies, :request, to: :warden
+      delegate :cookies, :env, to: :warden

      def initialize(warden)
        @warden = warden
--- a/lib/devise/hooks/rememberable.rb
+++ b/lib/devise/hooks/rememberable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 Warden::Manager.after_set_user except: :fetch do |record, warden, options|
  scope = options[:scope]
  if record.respond_to?(:remember_me) && options[:store] != false &&
--- a/lib/devise/hooks/timeoutable.rb
+++ b/lib/devise/hooks/timeoutable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 # Each time a record is set we check whether its session has already timed out
 # or not, based on last request time. If so, the record is logged out and
 # redirected to the sign in page. Also, each time the request comes and the
--- a/lib/devise/hooks/trackable.rb
+++ b/lib/devise/hooks/trackable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 # After each sign in, update sign in time, sign in count and sign in IP.
 # This is only triggered when the user is explicitly set (with set_user)
 # and on authentication. Retrieving the user from session (:fetch) does
--- a/lib/devise/mailers/helpers.rb
+++ b/lib/devise/mailers/helpers.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Mailers
    module Helpers
@@ -7,16 +5,15 @@ module Devise

      included do
        include Devise::Controllers::ScopedViews
+        attr_reader :scope_name, :resource
      end

      protected

-      attr_reader :scope_name, :resource
-
      # Configure default email options
-      def devise_mail(record, action, opts = {}, &block)
+      def devise_mail(record, action, opts={})
        initialize_from_record(record)
-        mail headers_for(action, opts), &block
+        mail headers_for(action, opts)
      end

      def initialize_from_record(record)
@@ -67,7 +64,7 @@ module Devise
        template_path
      end

-      # Set up a subject doing an I18n lookup. At first, it attempts to set a subject
+      # Setup a subject doing an I18n lookup. At first, it attempts to set a subject
      # based on the current mapping:
      #
      #   en:
--- a/lib/devise/mapping.rb
+++ b/lib/devise/mapping.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  # Responsible for handling devise mappings and routes configuration. Each
  # resource configured by devise_for in routes is actually creating a mapping
--- a/lib/devise/models.rb
+++ b/lib/devise/models.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Models
    class MissingAttribute < StandardError
@@ -14,7 +12,7 @@ module Devise

    # Creates configuration values for Devise and for the given module.
    #
-    #   Devise::Models.config(Devise::Models::DatabaseAuthenticatable, :stretches)
+    #   Devise::Models.config(Devise::DatabaseAuthenticatable, :stretches)
    #
    # The line above creates:
    #
--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -1,5 +1,4 @@
-# frozen_string_literal: true
-
+require 'active_model/version'
 require 'devise/hooks/activatable'
 require 'devise/hooks/csrf_cleaner'

@@ -103,7 +102,7 @@ module Devise
      # and passing a new list of attributes you want to exempt. All attributes
      # given to :except will simply add names to exempt to Devise internal list.
      def serializable_hash(options = nil)
-        options = options.try(:dup) || {}
+        options ||= {}
        options[:except] = Array(options[:except])

        if options[:force_except]
@@ -115,15 +114,6 @@ module Devise
        super(options)
      end

-      # Redefine inspect using serializable_hash, to ensure we don't accidentally
-      # leak passwords into exceptions.
-      def inspect
-        inspection = serializable_hash.collect do |k,v|
-          "#{k}: #{respond_to?(:attribute_for_inspect) ? attribute_for_inspect(k) : v.inspect}"
-        end
-        "#<#{self.class} #{inspection.join(", ")}>"
-      end
-
      protected

      def devise_mailer
@@ -133,18 +123,16 @@ module Devise
      # This is an internal method called every time Devise needs
      # to send a notification/mail. This can be overridden if you
      # need to customize the e-mail delivery logic. For instance,
-      # if you are using a queue to deliver e-mails (active job, delayed
-      # job, sidekiq, resque, etc), you must add the delivery to the queue
+      # if you are using a queue to deliver e-mails (delayed job,
+      # sidekiq, resque, etc), you must add the delivery to the queue
      # just after the transaction was committed. To achieve this,
      # you can override send_devise_notification to store the
-      # deliveries until the after_commit callback is triggered.
-      #
-      # The following example uses Active Job's `deliver_later` :
+      # deliveries until the after_commit callback is triggered:
      #
      #     class User
      #       devise :database_authenticatable, :confirmable
      #
-      #       after_commit :send_pending_devise_notifications
+      #       after_commit :send_pending_notifications
      #
      #       protected
      #
@@ -152,45 +140,27 @@ module Devise
      #         # If the record is new or changed then delay the
      #         # delivery until the after_commit callback otherwise
      #         # send now because after_commit will not be called.
-      #         # For Rails < 6 is `changed?` instead of `saved_changes?`.
-      #         if new_record? || saved_changes?
-      #           pending_devise_notifications << [notification, args]
+      #         if new_record? || changed?
+      #           pending_notifications << [notification, args]
      #         else
-      #           render_and_send_devise_message(notification, *args)
+      #           devise_mailer.send(notification, self, *args).deliver
      #         end
      #       end
      #
-      #       private
-      #
-      #       def send_pending_devise_notifications
-      #         pending_devise_notifications.each do |notification, args|
-      #           render_and_send_devise_message(notification, *args)
+      #       def send_pending_notifications
+      #         pending_notifications.each do |notification, args|
+      #           devise_mailer.send(notification, self, *args).deliver
      #         end
      #
      #         # Empty the pending notifications array because the
      #         # after_commit hook can be called multiple times which
      #         # could cause multiple emails to be sent.
-      #         pending_devise_notifications.clear
+      #         pending_notifications.clear
      #       end
      #
-      #       def pending_devise_notifications
-      #         @pending_devise_notifications ||= []
+      #       def pending_notifications
+      #         @pending_notifications ||= []
      #       end
-      #
-      #       def render_and_send_devise_message(notification, *args)
-      #         message = devise_mailer.send(notification, self, *args)
-      #
-      #         # Deliver later with Active Job's `deliver_later`
-      #         if message.respond_to?(:deliver_later)
-      #           message.deliver_later
-      #         # Remove once we move to Rails 4.2+ only, as `deliver` is deprecated.
-      #         elsif message.respond_to?(:deliver_now)
-      #           message.deliver_now
-      #         else
-      #           message.deliver
-      #         end
-      #       end
-      #
      #     end
      #
      def send_devise_notification(notification, *args)
@@ -265,7 +235,7 @@ module Devise
        #   end
        #
        # Finally, notice that Devise also queries for users in other scenarios
-        # besides authentication, for example when retrieving a user to send
+        # besides authentication, for example when retrieving an user to send
        # an e-mail for password reset. In such cases, find_for_authentication
        # is not called.
        def find_for_authentication(tainted_conditions)
@@ -283,20 +253,24 @@ module Devise

        # Find or initialize a record with group of attributes based on a list of required attributes.
        def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
-          attributes.try(:permit!)
-          attributes = attributes.to_h.with_indifferent_access
-                                 .slice(*required_attributes)
-                                 .delete_if { |key, value| value.blank? }
+          attributes = attributes.slice(*required_attributes).with_indifferent_access
+          attributes.delete_if { |key, value| value.blank? }

          if attributes.size == required_attributes.size
-            record = find_first_by_auth_conditions(attributes) and return record
+            record = find_first_by_auth_conditions(attributes)
          end

-          new(devise_parameter_filter.filter(attributes)).tap do |record|
+          unless record
+            record = new
+
            required_attributes.each do |key|
-              record.errors.add(key, attributes[key].blank? ? :blank : error)
+              value = attributes[key]
+              record.send("#{key}=", value)
+              record.errors.add(key, value.present? ? error : :blank)
            end
          end
+
+          record
        end

        protected
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Models
    # Confirmable is responsible to verify if an account is already confirmed to
@@ -26,11 +24,9 @@ module Devise
    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
-    #     db field to be set up (t.reconfirmable in migrations). Until confirmed, new email is
+    #     db field to be setup (t.reconfirmable in migrations). Until confirmed, new email is
    #     stored in unconfirmed email column, and copied to email column on successful
-    #     confirmation. Also, when used in conjunction with `send_email_changed_notification`,
-    #     the notification is sent to the original email when the change is requested,
-    #     not when the unconfirmed email is confirmed.
+    #     confirmation.
    #   * +confirm_within+: the time before a sent confirmation token becomes invalid.
    #     You can use this to force the user to confirm within a set period of time.
    #     Confirmable will not generate a new token if a repeat confirmation is requested
@@ -44,23 +40,17 @@ module Devise
    #
    module Confirmable
      extend ActiveSupport::Concern
+      include ActionView::Helpers::DateHelper

      included do
        before_create :generate_confirmation_token, if: :confirmation_required?
-        after_create :skip_reconfirmation_in_callback!, if: :send_confirmation_notification?
-        if defined?(ActiveRecord) && self < ActiveRecord::Base # ActiveRecord
-          after_commit :send_on_create_confirmation_instructions, on: :create, if: :send_confirmation_notification?
-          after_commit :send_reconfirmation_instructions, on: :update, if: :reconfirmation_required?
-        else # Mongoid
-          after_create :send_on_create_confirmation_instructions, if: :send_confirmation_notification?
-          after_update :send_reconfirmation_instructions, if: :reconfirmation_required?
-        end
+        after_create  :send_on_create_confirmation_instructions, if: :send_confirmation_notification?
        before_update :postpone_email_change_until_confirmation_and_regenerate_confirmation_token, if: :postpone_email_change?
+        after_update  :send_reconfirmation_instructions,  if: :reconfirmation_required?
      end

      def initialize(*args, &block)
        @bypass_confirmation_postpone = false
-        @skip_reconfirmation_in_callback = false
        @reconfirmation_required = false
        @skip_confirmation_notification = false
        @raw_confirmation_token = nil
@@ -86,7 +76,7 @@ module Devise

          self.confirmed_at = Time.now.utc

-          saved = if pending_reconfirmation?
+          saved = if self.class.reconfirmable && unconfirmed_email.present?
            skip_reconfirmation!
            self.email = unconfirmed_email
            self.unconfirmed_email = nil
@@ -102,6 +92,11 @@ module Devise
        end
      end

+      def confirm!(args={})
+        ActiveSupport::Deprecation.warn "confirm! is deprecated in favor of confirm"
+        confirm(args)
+      end
+
      # Verifies whether a user is confirmed or not
      def confirmed?
        !!confirmed_at
@@ -170,12 +165,6 @@ module Devise

      protected

-        # To not require reconfirmation after creating with #save called in a
-        # callback call skip_create_confirmation!
-        def skip_reconfirmation_in_callback!
-          @skip_reconfirmation_in_callback = true
-        end
-
        # A callback method used to deliver confirmation
        # instructions on creation. This can be overridden
        # in models to map to a nice sign up e-mail.
@@ -191,7 +180,7 @@ module Devise
        # Checks if the confirmation for the user is within the limit time.
        # We do this by calculating if the difference between today and the
        # confirmation sent date does not exceed the confirm in time configured.
-        # allow_unconfirmed_access_for is a model configuration, must always be an integer value.
+        # Confirm_within is a model configuration, must always be an integer value.
        #
        # Example:
        #
@@ -211,10 +200,7 @@ module Devise
        #   confirmation_period_valid?   # will always return true
        #
        def confirmation_period_valid?
-          return true if self.class.allow_unconfirmed_access_for.nil?
-          return false if self.class.allow_unconfirmed_access_for == 0.days
-
-          confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
+          self.class.allow_unconfirmed_access_for.nil? || (confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago)
        end

        # Checks if the user confirmation happens before the token becomes invalid
@@ -230,7 +216,7 @@ module Devise
        #   confirmation_period_expired?  # will always return false
        #
        def confirmation_period_expired?
-          self.class.confirm_within && self.confirmation_sent_at && (Time.now.utc > self.confirmation_sent_at.utc + self.class.confirm_within)
+          self.class.confirm_within && self.confirmation_sent_at && (Time.now > self.confirmation_sent_at + self.class.confirm_within)
        end

        # Checks whether the record requires any confirmation.
@@ -249,7 +235,8 @@ module Devise
          if self.confirmation_token && !confirmation_period_expired?
            @raw_confirmation_token = self.confirmation_token
          else
-            self.confirmation_token = @raw_confirmation_token = Devise.friendly_token
+            raw, _ = Devise.token_generator.generate(self.class, :confirmation_token)
+            self.confirmation_token = @raw_confirmation_token = raw
            self.confirmation_sent_at = Time.now.utc
          end
        end
@@ -258,64 +245,28 @@ module Devise
          generate_confirmation_token && save(validate: false)
        end

-        if Devise.activerecord51?
-          def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
-            @reconfirmation_required = true
-            self.unconfirmed_email = self.email
-            self.email = self.email_in_database
-            self.confirmation_token = nil
-            generate_confirmation_token
-          end
-        else
-          def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
-            @reconfirmation_required = true
-            self.unconfirmed_email = self.email
-            self.email = self.email_was
-            self.confirmation_token = nil
-            generate_confirmation_token
-          end
+        def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
+          @reconfirmation_required = true
+          self.unconfirmed_email = self.email
+          self.email = self.email_was
+          self.confirmation_token = nil
+          generate_confirmation_token
        end

-        if Devise.activerecord51?
-          def postpone_email_change?
-            postpone = self.class.reconfirmable &&
-              will_save_change_to_email? &&
-              !@bypass_confirmation_postpone &&
-              self.email.present? &&
-              (!@skip_reconfirmation_in_callback || !self.email_in_database.nil?)
-            @bypass_confirmation_postpone = false
-            postpone
-          end
-        else
-          def postpone_email_change?
-            postpone = self.class.reconfirmable &&
-              email_changed? &&
-              !@bypass_confirmation_postpone &&
-              self.email.present? &&
-              (!@skip_reconfirmation_in_callback || !self.email_was.nil?)
-            @bypass_confirmation_postpone = false
-            postpone
-          end
+        def postpone_email_change?
+          postpone = self.class.reconfirmable && email_changed? && email_was.present? && !@bypass_confirmation_postpone && self.email.present?
+          @bypass_confirmation_postpone = false
+          postpone
        end

        def reconfirmation_required?
-          self.class.reconfirmable && @reconfirmation_required && (self.email.present? || self.unconfirmed_email.present?)
+          self.class.reconfirmable && @reconfirmation_required && self.email.present?
        end

        def send_confirmation_notification?
          confirmation_required? && !@skip_confirmation_notification && self.email.present?
        end

-        # With reconfirmable, notify the original email when the user first
-        # requests the email change, instead of when the change is confirmed.
-        def send_email_changed_notification?
-          if self.class.reconfirmable
-            self.class.send_email_changed_notification && reconfirmation_required?
-          else
-            super
-          end
-        end
-
        # A callback initiated after successfully confirming. This can be
        # used to insert your own logic that is only run after the user successfully
        # confirms.
@@ -348,19 +299,7 @@ module Devise
        # If the user is already confirmed, create an error for the user
        # Options must have the confirmation_token
        def confirm_by_token(confirmation_token)
-          # When the `confirmation_token` parameter is blank, if there are any users with a blank
-          # `confirmation_token` in the database, the first one would be confirmed here.
-          # The error is being manually added here to ensure no users are confirmed by mistake.
-          # This was done in the model for convenience, since validation errors are automatically
-          # displayed in the view.
-          if confirmation_token.blank?
-            confirmable = new
-            confirmable.errors.add(:confirmation_token, :blank)
-            return confirmable
-          end
-
          confirmable = find_first_by_auth_conditions(confirmation_token: confirmation_token)
-
          unless confirmable
            confirmation_digest = Devise.token_generator.digest(self, :confirmation_token, confirmation_token)
            confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_digest)
@@ -376,7 +315,6 @@ module Devise

        # Find a record for confirmation by unconfirmed email field
        def find_by_unconfirmed_email_with_errors(attributes = {})
-          attributes = attributes.slice(*confirmation_keys).permit!.to_h if attributes.respond_to? :permit
          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
          unconfirmed_attributes = attributes.symbolize_keys
          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
--- a/lib/devise/models/database_authenticatable.rb
+++ b/lib/devise/models/database_authenticatable.rb
@@ -1,25 +1,24 @@
-# frozen_string_literal: true
-
 require 'devise/strategies/database_authenticatable'

 module Devise
+  def self.bcrypt(klass, password)
+    ActiveSupport::Deprecation.warn "Devise.bcrypt is deprecated; use Devise::Encryptor.digest instead"
+    Devise::Encryptor.digest(klass, password)
+  end
+
  module Models
-    # Authenticatable Module, responsible for hashing the password and
-    # validating the authenticity of a user while signing in.
+    # Authenticatable Module, responsible for encrypting password and validating
+    # authenticity of a user while signing in.
    #
    # == Options
    #
    # DatabaseAuthenticatable adds the following options to devise_for:
    #
    #   * +pepper+: a random string used to provide a more secure hash. Use
-    #     `rails secret` to generate new keys.
+    #     `rake secret` to generate new keys.
    #
    #   * +stretches+: the cost given to bcrypt.
    #
-    #   * +send_email_changed_notification+: notify original email when it changes.
-    #
-    #   * +send_password_change_notification+: notify email when password changes.
-    #
    # == Examples
    #
    #    User.find(1).valid_password?('password123')         # returns true/false
@@ -28,36 +27,17 @@ module Devise
      extend ActiveSupport::Concern

      included do
-        after_update :send_email_changed_notification, if: :send_email_changed_notification?
        after_update :send_password_change_notification, if: :send_password_change_notification?

        attr_reader :password, :current_password
        attr_accessor :password_confirmation
      end

-      def initialize(*args, &block)
-        @skip_email_changed_notification = false
-        @skip_password_change_notification = false
-        super 
-      end
-
-      # Skips sending the email changed notification after_update
-      def skip_email_changed_notification!
-        @skip_email_changed_notification = true
-      end
-
-      # Skips sending the password change notification after_update
-      def skip_password_change_notification!
-        @skip_password_change_notification = true
-      end
-
      def self.required_fields(klass)
        [:encrypted_password] + klass.authentication_keys
      end

-      # Generates a hashed password based on the given value.
-      # For legacy reasons, we use `encrypted_password` to store
-      # the hashed password.
+      # Generates password encryption based on the given value.
      def password=(new_password)
        @password = new_password
        self.encrypted_password = password_digest(@password) if @password.present?
@@ -81,15 +61,6 @@ module Devise
      # their password). In case the password field is rejected, the confirmation
      # is also rejected as long as it is also blank.
      def update_with_password(params, *options)
-        if options.present?
-          ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
-            [Devise] The second argument of `DatabaseAuthenticatable#update_with_password`
-            (`options`) is deprecated and it will be removed in the next major version.
-            It was added to support a feature deprecated in Rails 4, so you can safely remove it
-            from your code.
-          DEPRECATION
-        end
-
        current_password = params.delete(:current_password)

        if params[:password].blank?
@@ -98,11 +69,11 @@ module Devise
        end

        result = if valid_password?(current_password)
-          update(params, *options)
+          update_attributes(params, *options)
        else
-          assign_attributes(params, *options)
-          valid?
-          errors.add(:current_password, current_password.blank? ? :blank : :invalid)
+          self.assign_attributes(params, *options)
+          self.valid?
+          self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
          false
        end

@@ -123,19 +94,10 @@ module Devise
      #   end
      #
      def update_without_password(params, *options)
-        if options.present?
-          ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
-            [Devise] The second argument of `DatabaseAuthenticatable#update_without_password`
-            (`options`) is deprecated and it will be removed in the next major version.
-            It was added to support a feature deprecated in Rails 4, so you can safely remove it
-            from your code.
-          DEPRECATION
-        end
-
        params.delete(:password)
        params.delete(:password_confirmation)

-        result = update(params, *options)
+        result = update_attributes(params, *options)
        clean_up_passwords
        result
      end
@@ -147,8 +109,8 @@ module Devise
        result = if valid_password?(current_password)
          destroy
        else
-          valid?
-          errors.add(:current_password, current_password.blank? ? :blank : :invalid)
+          self.valid?
+          self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
          false
        end

@@ -173,56 +135,27 @@ module Devise
        encrypted_password[0,29] if encrypted_password
      end

-      if Devise.activerecord51?
-        # Send notification to user when email changes.
-        def send_email_changed_notification
-          send_devise_notification(:email_changed, to: email_before_last_save)
-        end
-      else
-        # Send notification to user when email changes.
-        def send_email_changed_notification
-          send_devise_notification(:email_changed, to: email_was)
-        end
-      end
-
-      # Send notification to user when password changes.
      def send_password_change_notification
        send_devise_notification(:password_change)
      end

    protected

-      # Hashes the password using bcrypt. Custom hash functions should override
+      # Digests the password using bcrypt. Custom encryption should override
      # this method to apply their own algorithm.
      #
      # See https://github.com/plataformatec/devise-encryptable for examples
-      # of other hashing engines.
+      # of other encryption engines.
      def password_digest(password)
        Devise::Encryptor.digest(self.class, password)
      end

-      if Devise.activerecord51?
-        def send_email_changed_notification?
-          self.class.send_email_changed_notification && saved_change_to_email? && !@skip_email_changed_notification
-        end
-      else
-        def send_email_changed_notification?
-          self.class.send_email_changed_notification && email_changed? && !@skip_email_changed_notification
-        end
-      end
-
-      if Devise.activerecord51?
-        def send_password_change_notification?
-          self.class.send_password_change_notification && saved_change_to_encrypted_password? && !@skip_password_change_notification
-        end
-      else
-        def send_password_change_notification?
-          self.class.send_password_change_notification && encrypted_password_changed? && !@skip_password_change_notification
-        end
+      def send_password_change_notification?
+        self.class.send_password_change_notification && encrypted_password_changed?
      end

      module ClassMethods
-        Devise::Models.config(self, :pepper, :stretches, :send_email_changed_notification, :send_password_change_notification)
+        Devise::Models.config(self, :pepper, :stretches, :send_password_change_notification)

        # We assume this method already gets the sanitized values from the
        # DatabaseAuthenticatable strategy. If you are using this method on
--- a/lib/devise/models/lockable.rb
+++ b/lib/devise/models/lockable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require "devise/hooks/lockable"

 module Devise
@@ -9,7 +7,7 @@ module Devise
    # blocked: email and time. The former will send an email to the user when
    # the lock happens, containing a link to unlock its account. The second
    # will unlock the user automatically after some configured time (ie 2.hours).
-    # It's also possible to set up lockable to use both email and time strategies.
+    # It's also possible to setup lockable to use both email and time strategies.
    #
    # == Options
    #
@@ -66,7 +64,7 @@ module Devise
      def send_unlock_instructions
        raw, enc = Devise.token_generator.generate(self.class, :unlock_token)
        self.unlock_token = enc
-        save(validate: false)
+        self.save(validate: false)
        send_devise_notification(:unlock_instructions, raw, {})
        raw
      end
@@ -101,7 +99,8 @@ module Devise
        if super && !access_locked?
          true
        else
-          increment_failed_attempts
+          self.failed_attempts ||= 0
+          self.failed_attempts += 1
          if attempts_exceeded?
            lock_access! unless access_locked?
          else
@@ -110,11 +109,6 @@ module Devise
          false
        end
      end
-      
-      def increment_failed_attempts
-        self.class.increment_counter(:failed_attempts, id)
-        reload
-      end

      def unauthenticated_message
        # If set to paranoid mode, do not show the locked message because it
@@ -161,9 +155,6 @@ module Devise
        end

      module ClassMethods
-        # List of strategies that are enabled/supported if :both is used.
-        BOTH_STRATEGIES = [:time, :email]
-
        # Attempt to find a user by its unlock keys. If a record is found, send new
        # unlock instructions to it. If not user is found, returns a new user
        # with an email not found error.
@@ -190,8 +181,7 @@ module Devise

        # Is the unlock enabled for the given unlock strategy?
        def unlock_strategy_enabled?(strategy)
-          self.unlock_strategy == strategy ||
-            (self.unlock_strategy == :both && BOTH_STRATEGIES.include?(strategy))
+          [:both, strategy].include?(self.unlock_strategy)
        end

        # Is the lock enabled for the given lock strategy?
--- a/lib/devise/models/omniauthable.rb
+++ b/lib/devise/models/omniauthable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/omniauth'

 module Devise
--- a/lib/devise/models/recoverable.rb
+++ b/lib/devise/models/recoverable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Models

@@ -29,20 +27,30 @@ module Devise
      end

      included do
-        before_update :clear_reset_password_token, if: :clear_reset_password_token?
+        before_update do
+          if (respond_to?(:email_changed?) && email_changed?) || encrypted_password_changed?
+            clear_reset_password_token
+          end
+        end
      end

      # Update password saving the record and clearing token. Returns true if
      # the passwords are valid and the record was saved, false otherwise.
      def reset_password(new_password, new_password_confirmation)
-        if new_password.present?
-          self.password = new_password
-          self.password_confirmation = new_password_confirmation
-          save
-        else
-          errors.add(:password, :blank)
-          false
+        self.password = new_password
+        self.password_confirmation = new_password_confirmation
+
+        if respond_to?(:after_password_reset) && valid?
+          ActiveSupport::Deprecation.warn "after_password_reset is deprecated"
+          after_password_reset
        end
+
+        save
+      end
+
+      def reset_password!(new_password, new_password_confirmation)
+        ActiveSupport::Deprecation.warn "reset_password! is deprecated in favor of reset_password"
+        reset_password(new_password, new_password_confirmation)
      end

      # Resets reset password token and send reset password instructions by email.
@@ -91,7 +99,7 @@ module Devise

          self.reset_password_token   = enc
          self.reset_password_sent_at = Time.now.utc
-          save(validate: false)
+          self.save(validate: false)
          raw
        end

@@ -99,26 +107,6 @@ module Devise
          send_devise_notification(:reset_password_instructions, token, {})
        end

-        if Devise.activerecord51?
-          def clear_reset_password_token?
-            encrypted_password_changed = respond_to?(:will_save_change_to_encrypted_password?) && will_save_change_to_encrypted_password?
-            authentication_keys_changed = self.class.authentication_keys.any? do |attribute|
-              respond_to?("will_save_change_to_#{attribute}?") && send("will_save_change_to_#{attribute}?")
-            end
-
-            authentication_keys_changed || encrypted_password_changed
-          end
-        else
-          def clear_reset_password_token?
-            encrypted_password_changed = respond_to?(:encrypted_password_changed?) && encrypted_password_changed?
-            authentication_keys_changed = self.class.authentication_keys.any? do |attribute|
-              respond_to?("#{attribute}_changed?") && send("#{attribute}_changed?")
-            end
-
-            authentication_keys_changed || encrypted_password_changed
-          end
-        end
-
      module ClassMethods
        # Attempt to find a user by password reset token. If a user is found, return it
        # If a user is not found, return nil
--- a/lib/devise/models/registerable.rb
+++ b/lib/devise/models/registerable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Models
    # Registerable is responsible for everything related to registering a new
@@ -21,8 +19,6 @@ module Devise
        def new_with_session(params, session)
          new(params)
        end
-
-        Devise::Models.config(self, :sign_in_after_change_password)
      end
    end
  end
--- a/lib/devise/models/rememberable.rb
+++ b/lib/devise/models/rememberable.rb
@@ -1,12 +1,10 @@
-# frozen_string_literal: true
-
 require 'devise/strategies/rememberable'
 require 'devise/hooks/rememberable'
 require 'devise/hooks/forgetable'

 module Devise
  module Models
-    # Rememberable manages generating and clearing token for remembering the user
+    # Rememberable manages generating and clearing token for remember the user
    # from a saved cookie. Rememberable also has utility methods for dealing
    # with serializing the user into the cookie and back from the cookie, trying
    # to lookup the record based on the saved information.
@@ -41,14 +39,16 @@ module Devise
    module Rememberable
      extend ActiveSupport::Concern

-      attr_accessor :remember_me
+      attr_accessor :remember_me, :extend_remember_period

      def self.required_fields(klass)
        [:remember_created_at]
      end

-      def remember_me!
-        self.remember_token ||= self.class.remember_token if respond_to?(:remember_token)
+      # TODO: We were used to receive a extend period argument but we no longer do.
+      # Remove this for Devise 4.0.
+      def remember_me!(*)
+        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
        self.remember_created_at ||= Time.now.utc
        save(validate: false) if self.changed?
      end
@@ -62,12 +62,13 @@ module Devise
        save(validate: false)
      end

-      def remember_expires_at
-        self.class.remember_for.from_now
+      # Remember token should be expired if expiration time not overpass now.
+      def remember_expired?
+        remember_created_at.nil?
      end

-      def extend_remember_period
-        self.class.extend_remember_period
+      def remember_expires_at
+        self.class.remember_for.from_now
      end

      def rememberable_value
@@ -76,7 +77,7 @@ module Devise
        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt.presence)
          salt
        else
-          raise "authenticatable_salt returned nil for the #{self.class.name} model. " \
+          raise "authenticable_salt returned nil for the #{self.class.name} model. " \
            "In order to use rememberable, you must ensure a password is always set " \
            "or have a remember_token column in your model or implement your own " \
            "rememberable_value in the model with custom logic."
@@ -100,47 +101,21 @@ module Devise
      def after_remembered
      end

-      def remember_me?(token, generated_at)
-        # TODO: Normalize the JSON type coercion along with the Timeoutable hook
-        # in a single place https://github.com/plataformatec/devise/blob/ffe9d6d406e79108cf32a2c6a1d0b3828849c40b/lib/devise/hooks/timeoutable.rb#L14-L18
-        if generated_at.is_a?(String)
-          generated_at = time_from_json(generated_at)
-        end
-
-        # The token is only valid if:
-        # 1. we have a date
-        # 2. the current time does not pass the expiry period
-        # 3. the record has a remember_created_at date
-        # 4. the token date is bigger than the remember_created_at
-        # 5. the token matches
-        generated_at.is_a?(Time) &&
-         (self.class.remember_for.ago < generated_at) &&
-         (generated_at > (remember_created_at || Time.now).utc) &&
-         Devise.secure_compare(rememberable_value, token)
-      end
-
-      private
-
-      def time_from_json(value)
-        if value =~ /\A\d+\.\d+\Z/
-          Time.at(value.to_f)
-        else
-          Time.parse(value) rescue nil
-        end
-      end

      module ClassMethods
        # Create the cookie key using the record id and remember_token
        def serialize_into_cookie(record)
-          [record.to_key, record.rememberable_value, Time.now.utc.to_f.to_s]
+          [record.to_key, record.rememberable_value, Time.now.utc]
        end

        # Recreate the user based on the stored cookie
        def serialize_from_cookie(*args)
-          id, token, generated_at = *args
+          serialize_from_cookie_with_or_without_record(nil, args)
+        end

-          record = to_adapter.get(id)
-          record if record && record.remember_me?(token, generated_at)
+        # Check if the given record is the one serialized in cookie
+        def serialized_in_cookie?(record, *args)
+          !!serialize_from_cookie_with_or_without_record(record, args)
        end

        # Generate a token checking if one does not already exist in the database.
@@ -151,6 +126,29 @@ module Devise
          end
        end

+        private
+
+        def serialize_from_cookie_with_or_without_record(record, args)
+          id, token, generated_at = args
+
+          # The token is only valid if:
+          # 1. we have a date
+          # 2. the current time does not pass the expiry period
+          # 3. there is a record with the given id
+          # 4. the record has a remember_created_at date
+          # 5. the token date is bigger than the remember_created_at
+          # 6. the token matches
+          if generated_at &&
+             (self.remember_for.ago < generated_at) &&
+             (record ||= to_adapter.get(id)) && (id == record.to_key) &&
+             (generated_at > (record.remember_created_at || Time.now).utc) &&
+             Devise.secure_compare(record.rememberable_value, token)
+            record
+          end
+        end
+
+
+        # TODO: extend_remember_period is no longer used
        Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options, :expire_all_remember_me_on_sign_out)
      end
    end
--- a/lib/devise/models/timeoutable.rb
+++ b/lib/devise/models/timeoutable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/hooks/timeoutable'

 module Devise
--- a/lib/devise/models/trackable.rb
+++ b/lib/devise/models/trackable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/hooks/trackable'

 module Devise
@@ -22,7 +20,7 @@ module Devise
        self.last_sign_in_at     = old_current || new_current
        self.current_sign_in_at  = new_current

-        old_current, new_current = self.current_sign_in_ip, extract_ip_from(request)
+        old_current, new_current = self.current_sign_in_ip, request.remote_ip
        self.last_sign_in_ip     = old_current || new_current
        self.current_sign_in_ip  = new_current

@@ -31,21 +29,9 @@ module Devise
      end

      def update_tracked_fields!(request)
-        # We have to check if the user is already persisted before running
-        # `save` here because invalid users can be saved if we don't.
-        # See https://github.com/plataformatec/devise/issues/4673 for more details.
-        return if new_record?
-
        update_tracked_fields(request)
        save(validate: false)
      end
-
-      protected
-
-      def extract_ip_from(request)
-        request.remote_ip
-      end
-
    end
  end
 end
--- a/lib/devise/models/validatable.rb
+++ b/lib/devise/models/validatable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Models
    # Validatable creates all needed validations for a user email and password.
@@ -12,7 +10,7 @@ module Devise
    # Validatable adds the following options to devise_for:
    #
    #   * +email_regexp+: the regular expression used to validate e-mails;
-    #   * +password_length+: a range expressing password length. Defaults to 6..128.
+    #   * +password_length+: a range expressing password length. Defaults to 8..72.
    #
    module Validatable
      # All validations used by this module.
@@ -29,13 +27,8 @@ module Devise

        base.class_eval do
          validates_presence_of   :email, if: :email_required?
-          if Devise.activerecord51?
-            validates_uniqueness_of :email, allow_blank: true, case_sensitive: true, if: :will_save_change_to_email?
-            validates_format_of     :email, with: email_regexp, allow_blank: true, if: :will_save_change_to_email?
-          else
-            validates_uniqueness_of :email, allow_blank: true, if: :email_changed?
-            validates_format_of     :email, with: email_regexp, allow_blank: true, if: :email_changed?
-          end
+          validates_uniqueness_of :email, allow_blank: true, if: :email_changed?
+          validates_format_of     :email, with: email_regexp, allow_blank: true, if: :email_changed?

          validates_presence_of     :password, if: :password_required?
          validates_confirmation_of :password, if: :password_required?
--- a/lib/devise/modules.rb
+++ b/lib/devise/modules.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'active_support/core_ext/object/with_options'

 Devise.with_options model: true do |d|
--- a/lib/devise/omniauth.rb
+++ b/lib/devise/omniauth.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 begin
  require "omniauth"
  require "omniauth/version"
--- a/lib/devise/omniauth/config.rb
+++ b/lib/devise/omniauth/config.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module OmniAuth
    class StrategyNotFound < NameError
--- a/lib/devise/omniauth/url_helpers.rb
+++ b/lib/devise/omniauth/url_helpers.rb
@@ -1,26 +1,17 @@
-# frozen_string_literal: true
-
 module Devise
  module OmniAuth
    module UrlHelpers
-      def omniauth_authorize_path(resource_or_scope, provider, *args)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_path", *args)
+      def self.define_helpers(mapping)
      end

-      def omniauth_authorize_url(resource_or_scope, provider, *args)
+      def omniauth_authorize_path(resource_or_scope, *args)
        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_url", *args)
+        _devise_route_context.send("#{scope}_omniauth_authorize_path", *args)
      end

-      def omniauth_callback_path(resource_or_scope, provider, *args)
+      def omniauth_callback_path(resource_or_scope, *args)
        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_path", *args)
-      end
-
-      def omniauth_callback_url(resource_or_scope, provider, *args)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_url", *args)
+        _devise_route_context.send("#{scope}_omniauth_callback_path", *args)
      end
    end
  end
--- a/lib/devise/orm/active_record.rb
+++ b/lib/devise/orm/active_record.rb
@@ -1,7 +1,3 @@
-# frozen_string_literal: true
-
 require 'orm_adapter/adapters/active_record'

-ActiveSupport.on_load(:active_record) do
-  extend Devise::Models
-end
+ActiveRecord::Base.extend Devise::Models
--- a/lib/devise/orm/mongoid.rb
+++ b/lib/devise/orm/mongoid.rb
@@ -1,7 +1,3 @@
-# frozen_string_literal: true
+require 'orm_adapter/adapters/mongoid'

-ActiveSupport.on_load(:mongoid) do
-  require 'orm_adapter/adapters/mongoid'
-
-  Mongoid::Document::ClassMethods.send :include, Devise::Models
-end
+Mongoid::Document::ClassMethods.send :include, Devise::Models
--- a/lib/devise/parameter_filter.rb
+++ b/lib/devise/parameter_filter.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  class ParameterFilter
    def initialize(case_insensitive_keys, strip_whitespace_keys)
@@ -18,8 +16,6 @@ module Devise

    def filtered_hash_by_method_for_given_keys(conditions, method, condition_keys)
      condition_keys.each do |k|
-        next unless conditions.key?(k)
-
        value = conditions[k]
        conditions[k] = value.send(method) if value.respond_to?(method)
      end
--- a/lib/devise/parameter_sanitizer.rb
+++ b/lib/devise/parameter_sanitizer.rb
@@ -1,173 +1,99 @@
-# frozen_string_literal: true
-
 module Devise
-  # The +ParameterSanitizer+ deals with permitting specific parameters values
-  # for each +Devise+ scope in the application.
-  #
-  # The sanitizer knows about Devise default parameters (like +password+ and
-  # +password_confirmation+ for the `RegistrationsController`), and you can
-  # extend or change the permitted parameters list on your controllers.
-  #
-  # === Permitting new parameters
-  #
-  # You can add new parameters to the permitted list using the +permit+ method
-  # in a +before_action+ method, for instance.
-  #
-  #    class ApplicationController < ActionController::Base
-  #      before_action :configure_permitted_parameters, if: :devise_controller?
-  #
-  #      protected
-  #
-  #      def configure_permitted_parameters
-  #        # Permit the `subscribe_newsletter` parameter along with the other
-  #        # sign up parameters.
-  #        devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
-  #      end
-  #    end
-  #
-  # Using a block yields an +ActionController::Parameters+ object so you can
-  # permit nested parameters and have more control over how the parameters are
-  # permitted in your controller.
-  #
-  #    def configure_permitted_parameters
-  #      devise_parameter_sanitizer.permit(:sign_up) do |user|
-  #        user.permit(newsletter_preferences: [])
-  #      end
-  #    end
-  class ParameterSanitizer
-    DEFAULT_PERMITTED_ATTRIBUTES = {
-      sign_in: [:password, :remember_me],
-      sign_up: [:password, :password_confirmation],
-      account_update: [:password, :password_confirmation, :current_password]
-    }
+  class BaseSanitizer
+    attr_reader :params, :resource_name, :resource_class

    def initialize(resource_class, resource_name, params)
-      @auth_keys      = extract_auth_keys(resource_class)
-      @params         = params
+      @resource_class = resource_class
      @resource_name  = resource_name
-      @permitted      = {}
-
-      DEFAULT_PERMITTED_ATTRIBUTES.each_pair do |action, keys|
-        permit(action, keys: keys)
-      end
+      @params         = params
+      @blocks         = Hash.new
    end

-    # Sanitize the parameters for a specific +action+.
-    #
-    # === Arguments
-    #
-    # * +action+ - A +Symbol+ with the action that the controller is
-    #   performing, like +sign_up+, +sign_in+, etc.
-    #
-    # === Examples
-    #
-    #    # Inside the `RegistrationsController#create` action.
-    #    resource = build_resource(devise_parameter_sanitizer.sanitize(:sign_up))
-    #    resource.save
-    #
-    # Returns an +ActiveSupport::HashWithIndifferentAccess+ with the permitted
-    # attributes.
-    def sanitize(action)
-      permissions = @permitted[action]
-
-      if permissions.respond_to?(:call)
-        cast_to_hash permissions.call(default_params)
-      elsif permissions.present?
-        cast_to_hash permit_keys(default_params, permissions)
-      else
-        unknown_action!(action)
-      end
-    end
-
-    # Add or remove new parameters to the permitted list of an +action+.
-    #
-    # === Arguments
-    #
-    # * +action+ - A +Symbol+ with the action that the controller is
-    #   performing, like +sign_up+, +sign_in+, etc.
-    # * +keys:+     - An +Array+ of keys that also should be permitted.
-    # * +except:+   - An +Array+ of keys that shouldn't be permitted.
-    # * +block+     - A block that should be used to permit the action
-    #   parameters instead of the +Array+ based approach. The block will be
-    #   called with an +ActionController::Parameters+ instance.
-    #
-    # === Examples
-    #
-    #   # Adding new parameters to be permitted in the `sign_up` action.
-    #   devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
-    #
-    #   # Removing the `password` parameter from the `account_update` action.
-    #   devise_parameter_sanitizer.permit(:account_update, except: [:password])
-    #
-    #   # Using the block form to completely override how we permit the
-    #   # parameters for the `sign_up` action.
-    #   devise_parameter_sanitizer.permit(:sign_up) do |user|
-    #     user.permit(:email, :password, :password_confirmation)
-    #   end
-    #
-    #
-    # Returns nothing.
-    def permit(action, keys: nil, except: nil, &block)
+    def for(kind, &block)
      if block_given?
-        @permitted[action] = block
+        @blocks[kind] = block
+      else
+        default_for(kind)
      end
+    end

-      if keys.present?
-        @permitted[action] ||= @auth_keys.dup
-        @permitted[action].concat(keys)
-      end
-
-      if except.present?
-        @permitted[action] ||= @auth_keys.dup
-        @permitted[action] = @permitted[action] - except
+    def sanitize(kind)
+      if block = @blocks[kind]
+        block.call(default_params)
+      else
+        default_sanitize(kind)
      end
    end

    private

-    # Cast a sanitized +ActionController::Parameters+ to a +HashWithIndifferentAccess+
-    # that can be used elsewhere.
-    #
-    # Returns an +ActiveSupport::HashWithIndifferentAccess+.
-    def cast_to_hash(params)
-      # TODO: Remove the `with_indifferent_access` method call when we only support Rails 5+.
-      params && params.to_h.with_indifferent_access
+    def default_for(kind)
+      raise ArgumentError, "a block is expected in Devise base sanitizer"
+    end
+
+    def default_sanitize(kind)
+      default_params
    end

    def default_params
-      if hashable_resource_params?
-        @params.fetch(@resource_name)
+      params.fetch(resource_name, {})
+    end
+  end
+
+  class ParameterSanitizer < BaseSanitizer
+    def initialize(*)
+      super
+      @permitted = Hash.new { |h,k| h[k] = attributes_for(k) }
+    end
+
+    def sign_in
+      permit self.for(:sign_in)
+    end
+
+    def sign_up
+      permit self.for(:sign_up)
+    end
+
+    def account_update
+      permit self.for(:account_update)
+    end
+
+    private
+
+    # TODO: We do need to flatten so it works with strong_parameters
+    # gem. We should drop it once we move to Rails 4 only support.
+    def permit(keys)
+      default_params.permit(*Array(keys))
+    end
+
+    # Change for(kind) to return the values in the @permitted
+    # hash, allowing the developer to customize at runtime.
+    def default_for(kind)
+      @permitted[kind] || raise("No sanitizer provided for #{kind}")
+    end
+
+    def default_sanitize(kind)
+      if respond_to?(kind, true)
+        send(kind)
      else
-        empty_params
+        raise NotImplementedError, "Devise doesn't know how to sanitize parameters for #{kind}"
      end
    end

-    def hashable_resource_params?
-      @params[@resource_name].respond_to?(:permit)
+    def attributes_for(kind)
+      case kind
+      when :sign_in
+        auth_keys + [:password, :remember_me]
+      when :sign_up
+        auth_keys + [:password, :password_confirmation]
+      when :account_update
+        auth_keys + [:password, :password_confirmation, :current_password]
+      end
    end

-    def empty_params
-      ActionController::Parameters.new({})
-    end
-
-    def permit_keys(parameters, keys)
-      parameters.permit(*keys)
-    end
-
-    def extract_auth_keys(klass)
-      auth_keys = klass.authentication_keys
-
-      auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
-    end
-
-    def unknown_action!(action)
-      raise NotImplementedError, <<-MESSAGE.strip_heredoc
-        "Devise doesn't know how to sanitize parameters for '#{action}'".
-        If you want to define a new set of parameters to be sanitized use the
-        `permit` method first:
-
-          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
-      MESSAGE
+    def auth_keys
+      @auth_keys ||= @resource_class.authentication_keys.respond_to?(:keys) ?
+                       @resource_class.authentication_keys.keys : @resource_class.authentication_keys
    end
  end
 end
--- a/lib/devise/rails.rb
+++ b/lib/devise/rails.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/rails/routes'
 require 'devise/rails/warden_compat'

@@ -13,9 +11,7 @@ module Devise
    end

    # Force routes to be loaded if we are doing any eager load.
-    config.before_eager_load do |app|
-      app.reload_routes! if Devise.reload_routes
-    end
+    config.before_eager_load { |app| app.reload_routes! }

    initializer "devise.url_helpers" do
      Devise.include_helpers(Devise::Controllers)
@@ -34,19 +30,26 @@ module Devise
    end

    initializer "devise.secret_key" do |app|
-      Devise.secret_key ||= Devise::SecretKeyFinder.new(app).find
+      if app.respond_to?(:secrets)
+        Devise.secret_key ||= app.secrets.secret_key_base
+      elsif app.config.respond_to?(:secret_key_base)
+        Devise.secret_key ||= app.config.secret_key_base
+      end

      Devise.token_generator ||=
        if secret_key = Devise.secret_key
          Devise::TokenGenerator.new(
-            ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
+            Devise::CachingKeyGenerator.new(Devise::KeyGenerator.new(secret_key))
          )
        end
    end

-    initializer "devise.zeitwerk" do
-      if Devise.rails6_and_up? && Rails.autoloaders.zeitwerk_enabled? && !Object.const_defined?(Devise.parent_mailer)
-        Rails.autoloaders.main.ignore("#{__dir__}/app/mailers/devise/mailer.rb")
+    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
+      # Deprecate: Remove once we move to Rails 4 only.
+      ActionDispatch::Routing::RoutesProxy.class_eval do
+        def respond_to?(method, include_private = false)
+          super || routes.url_helpers.respond_to?(method)
+        end
      end
    end
  end
--- a/lib/devise/rails/routes.rb
+++ b/lib/devise/rails/routes.rb
@@ -1,12 +1,13 @@
-# frozen_string_literal: true
-
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"

-module Devise
-  module RouteSet
-    def finalize!
-      result = super
+module ActionDispatch::Routing
+  class RouteSet #:nodoc:
+    # Ensure Devise modules are included only after loading routes, because we
+    # need devise_for mappings already declared to create filters and helpers.
+    def finalize_with_devise!
+      result = finalize_without_devise!
+
      @devise_finalized ||= begin
        if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
          warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
@@ -20,16 +21,10 @@ module Devise
        Devise.regenerate_helpers!
        true
      end
+
      result
    end
-  end
-end
-
-module ActionDispatch::Routing
-  class RouteSet #:nodoc:
-    # Ensure Devise modules are included only after loading routes, because we
-    # need devise_for mappings already declared to create filters and helpers.
-    prepend Devise::RouteSet
+    alias_method_chain :finalize!, :devise
  end

  class Mapper
@@ -89,17 +84,17 @@ module ActionDispatch::Routing
    #
    # You can configure your routes with some options:
    #
-    #  * class_name: set up a different class to be looked up by devise, if it cannot be
+    #  * class_name: setup a different class to be looked up by devise, if it cannot be
    #    properly found by the route name.
    #
    #      devise_for :users, class_name: 'Account'
    #
-    #  * path: allows you to set up path name that will be used, as rails routes does.
-    #    The following route configuration would set up your route as /accounts instead of /users:
+    #  * path: allows you to setup path name that will be used, as rails routes does.
+    #    The following route configuration would setup your route as /accounts instead of /users:
    #
    #      devise_for :users, path: 'accounts'
    #
-    #  * singular: set up the singular name for the given resource. This is used as the helper methods
+    #  * singular: setup the singular name for the given resource. This is used as the helper methods
    #    names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
    #    and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
    #
@@ -110,7 +105,7 @@ module ActionDispatch::Routing
    #      end
    #
    #      class ManagerController < ApplicationController
-    #        before_action authenticate_manager!
+    #        before_filter authenticate_manager!
    #
    #        def show
    #          @manager = current_manager
@@ -135,10 +130,10 @@ module ActionDispatch::Routing
    #  * failure_app: a rack app which is invoked whenever there is a failure. Strings representing a given
    #    are also allowed as parameter.
    #
-    #  * sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :delete),
+    #  * sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :get),
    #    if you wish to restrict this to accept only :post or :delete requests you should do:
    #
-    #      devise_for :users, sign_out_via: [:get, :post]
+    #      devise_for :users, sign_out_via: [:post, :delete]
    #
    #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
    #
@@ -340,7 +335,7 @@ module ActionDispatch::Routing

    # Sets the devise scope to be used in the controller. If you have custom routes,
    # you are required to call this method (also aliased as :as) in order to specify
-    # to which controller it is targeted.
+    # to which controller it is targetted.
    #
    #   as :user do
    #     get "sign_in", to: "devise/sessions#new"
@@ -433,29 +428,27 @@ options to another `devise_for` call outside the scope. Here is an example:
    end
 ERROR
        end
-        current_scope = @scope.dup
-        if @scope.respond_to? :new
-          @scope = @scope.new path: nil
-        else
-          @scope[:path] = nil
-        end
+
+        path, @scope[:path] = @scope[:path], nil
        path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")

        set_omniauth_path_prefix!(path_prefix)

-        mapping.to.omniauth_providers.each do |provider|
-          match "#{path_prefix}/#{provider}",
-            to: "#{controllers[:omniauth_callbacks]}#passthru",
-            as: "#{provider}_omniauth_authorize",
-            via: [:get, :post]
+        providers = Regexp.union(mapping.to.omniauth_providers.map(&:to_s))

-          match "#{path_prefix}/#{provider}/callback",
-            to: "#{controllers[:omniauth_callbacks]}##{provider}",
-            as: "#{provider}_omniauth_callback",
-            via: [:get, :post]
-        end
+        match "#{path_prefix}/:provider",
+          constraints: { provider: providers },
+          to: "#{controllers[:omniauth_callbacks]}#passthru",
+          as: :omniauth_authorize,
+          via: [:get, :post]
+
+        match "#{path_prefix}/:action/callback",
+          constraints: { action: providers },
+          to: "#{controllers[:omniauth_callbacks]}#:action",
+          as: :omniauth_callback,
+          via: [:get, :post]
      ensure
-        @scope = current_scope
+        @scope[:path] = path
      end

      def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
@@ -464,11 +457,7 @@ ERROR
        exclusive = { as: new_as, path: new_path, module: nil }
        exclusive.merge!(options.slice(:constraints, :defaults, :options))

-        if @scope.respond_to? :new
-          @scope = @scope.new exclusive
-        else
-          exclusive.each_pair { |key, value| @scope[key] = value }
-        end
+        exclusive.each_pair { |key, value| @scope[key] = value }
        yield
      ensure
        @scope = current_scope
--- a/lib/devise/rails/warden_compat.rb
+++ b/lib/devise/rails/warden_compat.rb
@@ -1,12 +1,19 @@
-# frozen_string_literal: true
-
 module Warden::Mixins::Common
  def request
    @request ||= ActionDispatch::Request.new(env)
  end

+  # Deprecate: Remove this check once we move to Rails 4 only.
+  NULL_STORE =
+    defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
+      ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil
+
  def reset_session!
-    request.reset_session
+    # Calling reset_session on NULL_STORE causes it fail.
+    # This is a bug that needs to be fixed in Rails.
+    unless NULL_STORE && request.session.is_a?(NULL_STORE)
+      request.reset_session
+    end
  end

  def cookies
--- a/lib/devise/secret_key_finder.rb
+++ b/lib/devise/secret_key_finder.rb
@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-module Devise
-  class SecretKeyFinder
-    def initialize(application)
-      @application = application
-    end
-
-    def find
-      if @application.respond_to?(:credentials) && key_exists?(@application.credentials)
-        @application.credentials.secret_key_base
-      elsif @application.respond_to?(:secrets) && key_exists?(@application.secrets)
-        @application.secrets.secret_key_base
-      elsif @application.config.respond_to?(:secret_key_base) && key_exists?(@application.config)
-        @application.config.secret_key_base
-      elsif @application.respond_to?(:secret_key_base) && key_exists?(@application)
-        @application.secret_key_base
-      end
-    end
-
-    private
-
-    def key_exists?(object)
-      object.secret_key_base.present?
-    end
-  end
-end
--- a/lib/devise/strategies/authenticatable.rb
+++ b/lib/devise/strategies/authenticatable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/strategies/base'

 module Devise
@@ -28,7 +26,7 @@ module Devise
    private

      # Receives a resource and check if it is valid by calling valid_for_authentication?
-      # A block that will be triggered while validating can be optionally
+      # An optional block that will be triggered while validating can be optionally
      # given as parameter. Check Devise::Models::Authenticatable.valid_for_authentication?
      # for more information.
      #
--- a/lib/devise/strategies/base.rb
+++ b/lib/devise/strategies/base.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
  module Strategies
    # Base strategy for Devise. Responsible for verifying correct scope and mapping.
--- a/lib/devise/strategies/database_authenticatable.rb
+++ b/lib/devise/strategies/database_authenticatable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/strategies/authenticatable'

 module Devise
@@ -8,21 +6,16 @@ module Devise
    class DatabaseAuthenticatable < Authenticatable
      def authenticate!
        resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
-        hashed = false
+        encrypted = false

-        if validate(resource){ hashed = true; resource.valid_password?(password) }
+        if validate(resource){ encrypted = true; resource.valid_password?(password) }
          remember_me(resource)
          resource.after_database_authentication
          success!(resource)
        end

-        # In paranoid mode, hash the password even when a resource doesn't exist for the given authentication key.
-        # This is necessary to prevent enumeration attacks - e.g. the request is faster when a resource doesn't
-        # exist in the database if the password hashing algorithm is not called.
-        mapping.to.new.password = password if !hashed && Devise.paranoid
-        unless resource
-          Devise.paranoid ? fail(:invalid) : fail(:not_found_in_database)
-        end
+        mapping.to.new.password = password if !encrypted && Devise.paranoid
+        fail(:not_found_in_database) unless resource
      end
    end
  end
--- a/lib/devise/strategies/rememberable.rb
+++ b/lib/devise/strategies/rememberable.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'devise/strategies/authenticatable'

 module Devise
@@ -27,7 +25,8 @@ module Devise
        end

        if validate(resource)
-          remember_me(resource) if extend_remember_me?(resource)
+          remember_me(resource)
+          extend_remember_me_period(resource)
          resource.after_remembered
          success!(resource)
        end
@@ -44,8 +43,10 @@ module Devise

    private

-      def extend_remember_me?(resource)
-        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
+      def extend_remember_me_period(resource)
+        if resource.respond_to?(:extend_remember_period=)
+          resource.extend_remember_period = mapping.to.extend_remember_period
+        end
      end

      def remember_me?
--- a/lib/devise/test/controller_helpers.rb
+++ b/lib/devise/test/controller_helpers.rb
@@ -1,165 +0,0 @@
-# frozen_string_literal: true
-
-module Devise
-  module Test
-    # `Devise::Test::ControllerHelpers` provides a facility to test controllers
-    # in isolation when using `ActionController::TestCase` allowing you to
-    # quickly sign_in or sign_out a user. Do not use
-    # `Devise::Test::ControllerHelpers` in integration tests.
-    #
-    # Examples
-    #
-    #  class PostsTest < ActionController::TestCase
-    #    include Devise::Test::ControllerHelpers
-    #
-    #    test 'authenticated users can GET index' do
-    #      sign_in users(:bob)
-    #
-    #      get :index
-    #      assert_response :success
-    #    end
-    #  end
-    #
-    # Important: you should not test Warden specific behavior (like callbacks)
-    # using `Devise::Test::ControllerHelpers` since it is a stub of the actual
-    # behavior. Such callbacks should be tested in your integration suite instead.
-    module ControllerHelpers
-      extend ActiveSupport::Concern
-
-      included do
-        setup :setup_controller_for_warden, :warden
-      end
-
-      # Override process to consider warden.
-      def process(*)
-        _catch_warden { super }
-
-        @response
-      end
-
-      # We need to set up the environment variables and the response in the controller.
-      def setup_controller_for_warden #:nodoc:
-        @request.env['action_controller.instance'] = @controller
-      end
-
-      # Quick access to Warden::Proxy.
-      def warden #:nodoc:
-        @request.env['warden'] ||= begin
-          manager = Warden::Manager.new(nil) do |config|
-            config.merge! Devise.warden_config
-          end
-          Warden::Proxy.new(@request.env, manager)
-        end
-      end
-
-      # sign_in a given resource by storing its keys in the session.
-      # This method bypass any warden authentication callback.
-      #
-      # * +resource+ - The resource that should be authenticated
-      # * +scope+    - An optional +Symbol+ with the scope where the resource
-      #                should be signed in with.
-      # Examples:
-      #
-      # sign_in users(:alice)
-      # sign_in users(:alice), scope: :admin
-      def sign_in(resource, deprecated = nil, scope: nil)
-        if deprecated.present?
-          scope = resource
-          resource = deprecated
-
-          ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
-            [Devise] sign_in(:#{scope}, resource) on controller tests is deprecated and will be removed from Devise.
-            Please use sign_in(resource, scope: :#{scope}) instead.
-          DEPRECATION
-        end
-
-        scope ||= Devise::Mapping.find_scope!(resource)
-
-        warden.instance_variable_get(:@users).delete(scope)
-        warden.session_serializer.store(resource, scope)
-      end
-
-      # Sign out a given resource or scope by calling logout on Warden.
-      # This method bypass any warden logout callback.
-      #
-      # Examples:
-      #
-      #   sign_out :user     # sign_out(scope)
-      #   sign_out @user     # sign_out(resource)
-      #
-      def sign_out(resource_or_scope)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        @controller.instance_variable_set(:"@current_#{scope}", nil)
-        user = warden.instance_variable_get(:@users).delete(scope)
-        warden.session_serializer.delete(scope, user)
-      end
-
-      protected
-
-      # Catch warden continuations and handle like the middleware would.
-      # Returns nil when interrupted, otherwise the normal result of the block.
-      def _catch_warden(&block)
-        result = catch(:warden, &block)
-
-        env = @controller.request.env
-
-        result ||= {}
-
-        # Set the response. In production, the rack result is returned
-        # from Warden::Manager#call, which the following is modelled on.
-        case result
-        when Array
-          if result.first == 401 && intercept_401?(env) # does this happen during testing?
-            _process_unauthenticated(env)
-          else
-            result
-          end
-        when Hash
-          _process_unauthenticated(env, result)
-        else
-          result
-        end
-      end
-
-      def _process_unauthenticated(env, options = {})
-        options[:action] ||= :unauthenticated
-        proxy = request.env['warden']
-        result = options[:result] || proxy.result
-
-        ret = case result
-        when :redirect
-          body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
-          [proxy.status, proxy.headers, [body]]
-        when :custom
-          proxy.custom_response
-        else
-          request.env["PATH_INFO"] = "/#{options[:action]}"
-          request.env["warden.options"] = options
-          Warden::Manager._run_callbacks(:before_failure, env, options)
-
-          status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
-          @controller.response.headers.merge!(headers)
-          @controller.response.content_type = headers["Content-Type"] unless Rails::VERSION::MAJOR >= 5
-          @controller.status = status
-          @controller.response.body = response.body
-          nil # causes process return @response
-        end
-
-        # ensure that the controller response is set up. In production, this is
-        # not necessary since warden returns the results to rack. However, at
-        # testing time, we want the response to be available to the testing
-        # framework to verify what would be returned to rack.
-        if ret.is_a?(Array)
-          status, headers, body = *ret
-          # ensure the controller response is set to our response.
-          @controller.response ||= @response
-          @response.status = status
-          @response.headers.merge!(headers)
-          @response.body = body
-        end
-
-        ret
-      end
-    end
-  end
-end
--- a/lib/devise/test/integration_helpers.rb
+++ b/lib/devise/test/integration_helpers.rb
@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module Devise
-  # Devise::Test::IntegrationHelpers is a helper module for facilitating
-  # authentication on Rails integration tests to bypass the required steps for
-  # signin in or signin out a record.
-  #
-  # Examples
-  #
-  #  class PostsTest < ActionDispatch::IntegrationTest
-  #    include Devise::Test::IntegrationHelpers
-  #
-  #    test 'authenticated users can see posts' do
-  #      sign_in users(:bob)
-  #
-  #      get '/posts'
-  #      assert_response :success
-  #    end
-  #  end
-  module Test
-    module IntegrationHelpers
-      def self.included(base)
-        base.class_eval do
-          include Warden::Test::Helpers
-
-          setup :setup_integration_for_devise
-          teardown :teardown_integration_for_devise
-        end
-      end
-
-      # Signs in a specific resource, mimicking a successfull sign in
-      # operation through +Devise::SessionsController#create+.
-      #
-      # * +resource+ - The resource that should be authenticated
-      # * +scope+    - An optional +Symbol+ with the scope where the resource
-      #                should be signed in with.
-      def sign_in(resource, scope: nil)
-        scope ||= Devise::Mapping.find_scope!(resource)
-
-        login_as(resource, scope: scope)
-      end
-
-      # Signs out a specific scope from the session.
-      #
-      # * +resource_or_scope+ - The resource or scope that should be signed out.
-      def sign_out(resource_or_scope)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-
-        logout scope
-      end
-
-      protected
-
-      def setup_integration_for_devise
-        Warden.test_mode!
-      end
-
-      def teardown_integration_for_devise
-        Warden.test_reset!
-      end
-    end
-  end
-end
--- a/lib/devise/test_helpers.rb
+++ b/lib/devise/test_helpers.rb
@@ -1,15 +1,132 @@
-# frozen_string_literal: true
-
 module Devise
+  # Devise::TestHelpers provides a facility to test controllers in isolation
+  # when using ActionController::TestCase allowing you to quickly sign_in or
+  # sign_out a user. Do not use Devise::TestHelpers in integration tests.
+  #
+  # Notice you should not test Warden specific behavior (like Warden callbacks)
+  # using Devise::TestHelpers since it is a stub of the actual behavior. Such
+  # callbacks should be tested in your integration suite instead.
  module TestHelpers
    def self.included(base)
      base.class_eval do
-        ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
-          [Devise] including `Devise::TestHelpers` is deprecated and will be removed from Devise.
-          For controller tests, please include `Devise::Test::ControllerHelpers` instead.
-        DEPRECATION
-        include Devise::Test::ControllerHelpers
+        setup :setup_controller_for_warden, :warden if respond_to?(:setup)
      end
    end
+
+    # Override process to consider warden.
+    def process(*)
+      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
+      _catch_warden { super } || @response
+    end
+
+    # We need to setup the environment variables and the response in the controller.
+    def setup_controller_for_warden #:nodoc:
+      @request.env['action_controller.instance'] = @controller
+    end
+
+    # Quick access to Warden::Proxy.
+    def warden #:nodoc:
+      @request.env['warden'] ||= begin
+        manager = Warden::Manager.new(nil) do |config|
+          config.merge! Devise.warden_config
+        end
+        Warden::Proxy.new(@request.env, manager)
+      end
+    end
+
+    # sign_in a given resource by storing its keys in the session.
+    # This method bypass any warden authentication callback.
+    #
+    # Examples:
+    #
+    #   sign_in :user, @user   # sign_in(scope, resource)
+    #   sign_in @user          # sign_in(resource)
+    #
+    def sign_in(resource_or_scope, resource=nil)
+      scope    ||= Devise::Mapping.find_scope!(resource_or_scope)
+      resource ||= resource_or_scope
+      warden.instance_variable_get(:@users).delete(scope)
+      warden.session_serializer.store(resource, scope)
+    end
+
+    # Sign out a given resource or scope by calling logout on Warden.
+    # This method bypass any warden logout callback.
+    #
+    # Examples:
+    #
+    #   sign_out :user     # sign_out(scope)
+    #   sign_out @user     # sign_out(resource)
+    #
+    def sign_out(resource_or_scope)
+      scope = Devise::Mapping.find_scope!(resource_or_scope)
+      @controller.instance_variable_set(:"@current_#{scope}", nil)
+      user = warden.instance_variable_get(:@users).delete(scope)
+      warden.session_serializer.delete(scope, user)
+    end
+
+    protected
+
+    # Catch warden continuations and handle like the middleware would.
+    # Returns nil when interrupted, otherwise the normal result of the block.
+    def _catch_warden(&block)
+      result = catch(:warden, &block)
+
+      env = @controller.request.env
+
+      result ||= {}
+
+      # Set the response. In production, the rack result is returned
+      # from Warden::Manager#call, which the following is modelled on.
+      case result
+      when Array
+        if result.first == 401 && intercept_401?(env) # does this happen during testing?
+          _process_unauthenticated(env)
+        else
+          result
+        end
+      when Hash
+        _process_unauthenticated(env, result)
+      else
+        result
+      end
+    end
+
+    def _process_unauthenticated(env, options = {})
+      options[:action] ||= :unauthenticated
+      proxy = env['warden']
+      result = options[:result] || proxy.result
+
+      ret = case result
+      when :redirect
+        body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
+        [proxy.status, proxy.headers, [body]]
+      when :custom
+        proxy.custom_response
+      else
+        env["PATH_INFO"] = "/#{options[:action]}"
+        env["warden.options"] = options
+        Warden::Manager._run_callbacks(:before_failure, env, options)
+
+        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
+        @controller.response.headers.merge!(headers)
+        @controller.send :render, status: status, text: response.body,
+          content_type: headers["Content-Type"], location: headers["Location"]
+        nil # causes process return @response
+      end
+
+      # ensure that the controller response is set up. In production, this is
+      # not necessary since warden returns the results to rack. However, at
+      # testing time, we want the response to be available to the testing
+      # framework to verify what would be returned to rack.
+      if ret.is_a?(Array)
+        # ensure the controller response is set to our response.
+        @controller.response ||= @response
+        @response.status = ret.first
+        @response.headers = ret.second
+        @response.body = ret.third
+      end
+
+      ret
+    end
  end
 end
--- a/lib/devise/time_inflector.rb
+++ b/lib/devise/time_inflector.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require "active_support/core_ext/module/delegation"

 module Devise
--- a/lib/devise/token_generator.rb
+++ b/lib/devise/token_generator.rb
@@ -1,10 +1,11 @@
-# frozen_string_literal: true
-
+# Deprecate: Copied verbatim from Rails source, remove once we move to Rails 4 only.
+require 'thread_safe'
 require 'openssl'
+require 'securerandom'

 module Devise
  class TokenGenerator
-    def initialize(key_generator, digest = "SHA256")
+    def initialize(key_generator, digest="SHA256")
      @key_generator = key_generator
      @digest = digest
    end
@@ -29,4 +30,41 @@ module Devise
      @key_generator.generate_key("Devise #{column}")
    end
  end
+
+  # KeyGenerator is a simple wrapper around OpenSSL's implementation of PBKDF2
+  # It can be used to derive a number of keys for various purposes from a given secret.
+  # This lets Rails applications have a single secure secret, but avoid reusing that
+  # key in multiple incompatible contexts.
+  class KeyGenerator
+    def initialize(secret, options = {})
+      @secret = secret
+      # The default iterations are higher than required for our key derivation uses
+      # on the off chance someone uses this for password storage
+      @iterations = options[:iterations] || 2**16
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
+    end
+  end
+
+  # CachingKeyGenerator is a wrapper around KeyGenerator which allows users to avoid
+  # re-executing the key generation process when it's called using the same salt and
+  # key_size
+  class CachingKeyGenerator
+    def initialize(key_generator)
+      @key_generator = key_generator
+      @cache_keys = ThreadSafe::Cache.new
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      @cache_keys["#{salt}#{key_size}"] ||= @key_generator.generate_key(salt, key_size)
+    end
+  end
 end
--- a/lib/devise/version.rb
+++ b/lib/devise/version.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Devise
-  VERSION = "4.7.1".freeze
+  VERSION = "3.5.5".freeze
 end
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
José Valim	8cbdeb54a5	Release v3.5.5	2016-01-22 20:22:34 +01:00
José Valim	14affc8a55	Do not timeout if remember me is enabled	2016-01-22 16:18:57 +01:00
José Valim	eb0f0b662f	Readd remember_expired?	2016-01-22 15:57:57 +01:00
José Valim	1516a0ae6d	Release v3.5.4	2016-01-18 15:12:07 +01:00
José Valim	c92996646a	Store creation timestamp on remember cookies Signed-off-by: José Valim <jose.valim@plataformatec.com.br>	2016-01-18 14:47:31 +01:00
Kacper Walanus	ba5dd0a41a	test for save in after_create hook breaks devise confirmation [3787]	2015-12-15 11:41:48 -02:00
Christian Macias	f63be5039a	changed email_was !='' to email_was.present?	2015-12-15 11:41:33 -02:00
Christian Macias	f25562fd4b	fix for #3787 , save in after_create hook breaks devise confirmation	2015-12-15 11:41:33 -02:00
Siva Gollapalli	2a2fd806a8	FIX# Comparing times in UTC	2015-12-15 11:40:59 -02:00