Release v3.5.5

Do not timeout if remember me is enabled
Readd remember_expired?
2026-01-11 08:37:56 -05:00 · 2016-01-22 20:22:34 +01:00 · 2016-01-22 16:18:57 +01:00 · 2016-01-22 15:57:57 +01:00 · 2016-01-18 15:12:07 +01:00 · 2016-01-18 14:47:31 +01:00
109 changed files with 2601 additions and 1671 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,22 +1,23 @@
 language: ruby

 rvm:
-  - 2.3.0
-  - 2.2.4
-  - 2.1.8
+  - 1.9.3
+  - 2.0.0
+  - 2.1
+  - 2.2

 gemfile:
-  - Gemfile
-  - gemfiles/Gemfile.rails-5.0-beta
  - gemfiles/Gemfile.rails-4.2-stable
  - gemfiles/Gemfile.rails-4.1-stable
+  - gemfiles/Gemfile.rails-4.0-stable
+  - gemfiles/Gemfile.rails-3.2-stable
+  - Gemfile

 matrix:
  exclude:
-    - rvm: 2.1.8
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
-    - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
+    - rvm: 2.2
+      gemfile: gemfiles/Gemfile.rails-3.2-stable
+
 services:
  - mongodb

@@ -26,19 +27,18 @@ cache: bundler

 env:
  matrix:
-    - DEVISE_ORM=active_record
    - DEVISE_ORM=mongoid
+    - DEVISE_ORM=active_record

 before_install: "rm ${BUNDLE_GEMFILE}.lock"

 before_script: "bundle update"

-script: "bin/test"
+script: "bundle exec rake test"

 notifications:
  email: false
  slack:
-    on_pull_requests: false
    on_success: change
    on_failure: always
    secure: Q3M+kmude3FjisibEeeGe0wSMXgvwLH+vL7Zrx9//q4QtkfnrQ/BBMvY9KXxPEsNF+eys4YopYjTkJ8uRmeboUATW/oQ4Jrv3+u3zkIHK2sFn/Q2cQWpK5w+CbgEnHPjKYnUu34b09njXTgDlr/mqtbPqrKeZ1dLlpKXCB/q4GY=
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/8
+++ b/8
@@ -2,9 +2,9 @@ source "https://rubygems.org"

 gemspec

-gem "rails", "~> 4.2.6"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "rails", "4.2.2"
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"

 group :test do
@@ -25,5 +25,5 @@ platforms :ruby do
 end

 group :mongoid do
-  gem "mongoid", "~> 5.0"
+  gem "mongoid", "~> 4.0"
 end
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,155 +1,159 @@
 PATH
  remote: .
  specs:
-    devise (4.0.1)
+    devise (3.5.5)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.1)
+      railties (>= 3.2.6, < 5)
      responders
+      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
-    actionmailer (4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
+    actionmailer (4.2.2)
+      actionpack (= 4.2.2)
+      actionview (= 4.2.2)
+      activejob (= 4.2.2)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.6)
-      actionview (= 4.2.6)
-      activesupport (= 4.2.6)
+    actionpack (4.2.2)
+      actionview (= 4.2.2)
+      activesupport (= 4.2.2)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.6)
-      activesupport (= 4.2.6)
+      rails-html-sanitizer (~> 1.0, >= 1.0.1)
+    actionview (4.2.2)
+      activesupport (= 4.2.2)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.6)
-      activesupport (= 4.2.6)
+      rails-html-sanitizer (~> 1.0, >= 1.0.1)
+    activejob (4.2.2)
+      activesupport (= 4.2.2)
      globalid (>= 0.3.0)
-    activemodel (4.2.6)
-      activesupport (= 4.2.6)
+    activemodel (4.2.2)
+      activesupport (= 4.2.2)
      builder (~> 3.1)
-    activerecord (4.2.6)
-      activemodel (= 4.2.6)
-      activesupport (= 4.2.6)
+    activerecord (4.2.2)
+      activemodel (= 4.2.2)
+      activesupport (= 4.2.2)
      arel (~> 6.0)
-    activesupport (4.2.6)
+    activesupport (4.2.2)
      i18n (~> 0.7)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    arel (6.0.3)
-    bcrypt (3.1.11)
-    bson (4.0.0)
+    arel (6.0.0)
+    bcrypt (3.1.10)
+    bson (3.1.2)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
+    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.2)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.6)
+    globalid (0.3.5)
      activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.0)
    i18n (0.7.0)
    json (1.8.3)
-    jwt (1.5.1)
-    loofah (2.0.3)
+    jwt (1.4.1)
+    loofah (2.0.2)
      nokogiri (>= 1.5.9)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.99.1)
-    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    mime-types (2.6.1)
+    mini_portile (0.6.2)
+    minitest (5.7.0)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
-    mongo (2.2.0)
-      bson (~> 4.0)
-    mongoid (5.0.1)
+    mongoid (4.0.2)
      activemodel (~> 4.0)
-      mongo (~> 2.1)
+      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    multi_json (1.11.2)
+    moped (2.0.6)
+      bson (~> 3.0)
+      connection_pool (~> 2.0)
+      optionable (~> 0.2.0)
+    multi_json (1.11.1)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.1.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
+      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.3.1)
+      rack (~> 1.2)
+    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
-      rack (>= 1.0, < 3)
-    omniauth-facebook (3.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
-    origin (2.2.0)
+    optionable (0.2.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (1.6.4)
+    rack (1.6.2)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rails (4.2.6)
-      actionmailer (= 4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
-      activemodel (= 4.2.6)
-      activerecord (= 4.2.6)
-      activesupport (= 4.2.6)
+    rails (4.2.2)
+      actionmailer (= 4.2.2)
+      actionpack (= 4.2.2)
+      actionview (= 4.2.2)
+      activejob (= 4.2.2)
+      activemodel (= 4.2.2)
+      activerecord (= 4.2.2)
+      activesupport (= 4.2.2)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.6)
+      railties (= 4.2.2)
      sprockets-rails
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
+    rails-dom-testing (1.0.6)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
+    rails-html-sanitizer (1.0.2)
      loofah (~> 2.0)
-    railties (4.2.6)
-      actionpack (= 4.2.6)
-      activesupport (= 4.2.6)
+    railties (4.2.2)
+      actionpack (= 4.2.2)
+      activesupport (= 4.2.2)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (11.0.1)
-    rdoc (4.2.2)
-      json (~> 1.4)
-    responders (2.1.2)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (2.1.1)
      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.0.4)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.11)
+    sprockets (3.2.0)
+      rack (~> 1.0)
+    sprockets-rails (2.3.1)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
    thor (0.19.1)
    thread_safe (0.3.5)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.6)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -165,12 +169,12 @@ DEPENDENCIES
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  mongoid (~> 5.0)
-  omniauth (~> 1.3)
+  mongoid (~> 4.0)
+  omniauth (~> 1.2.0)
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
+  omniauth-oauth2 (~> 1.1.0)
  omniauth-openid (~> 1.0.1)
-  rails (~> 4.2.6)
+  rails (= 4.2.2)
  rdoc
  sqlite3
  webrat (= 0.7.3)
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-Copyright 2009-2016 Plataformatec. http://plataformatec.com.br
+Copyright 2009-2015 Plataformatec. http://plataformatec.com.br

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ By [Plataformatec](http://plataformatec.com.br/).

 [![Build Status](https://api.travis-ci.org/plataformatec/devise.svg?branch=master)](http://travis-ci.org/plataformatec/devise)
 [![Code Climate](https://codeclimate.com/github/plataformatec/devise.svg)](https://codeclimate.com/github/plataformatec/devise)
+[![Security](https://hakiri.io/github/plataformatec/devise/master.svg)](https://hakiri.io/github/plataformatec/devise/master)

 This README is [also available in a friendly navigable format](http://devise.plataformatec.com.br/).

@@ -16,7 +17,7 @@ Devise is a flexible authentication solution for Rails based on Warden. It:

 It's composed of 10 modules:

-* [Database Authenticatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
+* [Database Authenticatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): encrypts and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
 * [Omniauthable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable): adds OmniAuth (https://github.com/intridea/omniauth) support.
 * [Confirmable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable): sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
 * [Recoverable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Recoverable): resets the user password and sends reset instructions.
@@ -27,6 +28,8 @@ It's composed of 10 modules:
 * [Validatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable): provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
 * [Lockable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Lockable): locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.

+Devise is guaranteed to be thread-safe on YARV. Thread-safety support on JRuby is in progress.
+
 ## Information

 ### The Devise wiki
@@ -89,7 +92,7 @@ Once you have solidified your understanding of Rails and authentication mechanis

 ## Getting started

-Devise 4.0 works with Rails 4.2 onwards. You can add it to your Gemfile with:
+Devise 3.0 works with Rails 3.2 onwards. You can add it to your Gemfile with:

 ```ruby
 gem 'devise'
@@ -109,7 +112,7 @@ The generator will install an initializer which describes ALL of Devise's config
 rails generate devise MODEL
 ```

-Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with the default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
+Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.

 Next, check the MODEL for any additional configuration options you might want to add, such as confirmable or lockable. If you add an option, be sure to inspect the migration file (created by the generator if your ORM supports them) and uncomment the appropriate section.  For example, if you add the confirmable option in the model, you'll need to uncomment the Confirmable section in the migration. Then run `rake db:migrate`

@@ -129,8 +132,6 @@ Devise will create some helpers to use inside your controllers and views. To set
 before_action :authenticate_user!
 ```

-For Rails 5, note that `protect_from_forgery` is no longer prepended to the `before_action` chain, so if you have set `authenticate_user` before `protect_from_forgery`, your request will result in "Can't verify CSRF token authenticity." To resolve this, either change the order in which you call them, or use `protect_from_forgery prepend: true`.
-
 If your devise model is something other than User, replace "_user" with "_yourmodel". The same logic applies to the instructions below.

 To verify if a user is signed in, use the following helper:
@@ -173,7 +174,7 @@ member_session

 ### Configuring Models

-The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the hashing algorithm with:
+The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the encryption algorithm with:

 ```ruby
 devise :database_authenticatable, :registerable, :confirmable, :recoverable, stretches: 20
@@ -183,13 +184,9 @@ Besides `:stretches`, you can define `:pepper`, `:encryptor`, `:confirm_within`,

 ### Strong Parameters

-![The Parameter Sanitizer API has changed for Devise 4](http://messages.hellobits.com/warning.svg?message=The%20Parameter%20Sanitizer%20API%20has%20changed%20for%20Devise%204)
-
-*For previous Devise versions see https://github.com/plataformatec/devise/tree/3-stable#strong-parameters*
-
 When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing Devise to handle this concern at the controller as well.

-There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and default permitted parameters are:
+There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permitted parameters by default are:

 * `sign_in` (`Devise::SessionsController#create`) - Permits only the authentication keys (like `email`)
 * `sign_up` (`Devise::RegistrationsController#create`) - Permits authentication keys plus `password` and `password_confirmation`
@@ -204,7 +201,7 @@ class ApplicationController < ActionController::Base
  protected

  def configure_permitted_parameters
-    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
+    devise_parameter_sanitizer.for(:sign_up) << :username
  end
 end
 ```
@@ -215,9 +212,7 @@ To permit simple scalar values for username and email, use this

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.permit(:sign_in) do |user_params|
-    user_params.permit(:username, :email)
-  end
+  devise_parameter_sanitizer.for(:sign_in) { |u| u.permit(:username, :email) }
 end
 ```

@@ -225,9 +220,7 @@ If you have some checkboxes that express the roles a user may take on registrati

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.permit(:sign_up) do |user_params|
-    user_params.permit({ roles: [] }, :email, :password, :password_confirmation)
-  end
+  devise_parameter_sanitizer.for(:sign_up) { |u| u.permit({ roles: [] }, :email, :password, :password_confirmation) }
 end
 ```
 For the list of permitted scalars, and how to declare permitted keys in nested hashes and arrays, see
@@ -238,9 +231,8 @@ If you have multiple Devise models, you may want to set up a different parameter

 ```ruby
 class User::ParameterSanitizer < Devise::ParameterSanitizer
-  def initialize(*)
-    super
-    permit(:sign_up, keys: [:username, :email])
+  def sign_in
+    default_params.permit(:username, :email)
  end
 end
 ```
@@ -355,7 +347,7 @@ Devise also ships with default routes. If you need to customize them, you should
 devise_for :users, path: "auth", path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
 ```

-Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/plataformatec/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for) for details.
+Be sure to check `devise_for` documentation for details.

 If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is create your routes normally and wrap them in a `devise_scope` block in the router:

@@ -411,7 +403,7 @@ Caution: Devise Controllers inherit from ApplicationController. If your app uses

 ### Test helpers

-Devise includes some test helpers for functional specs. In order to use them, you need to include Devise in your functional tests by adding the following to the bottom of your `test/test_helper.rb` file (make sure you place it out of scope of `ActiveSupport::TestCase` which is the default class inside of `test/test_helper.rb`):
+Devise includes some test helpers for functional specs. In order to use them, you need to include Devise in your functional tests by adding the following to the bottom of your `test/test_helper.rb` file:

 ```ruby
 class ActionController::TestCase
@@ -424,7 +416,6 @@ If you're using RSpec, you can put the following inside a file named `spec/suppo
 ```ruby
 RSpec.configure do |config|
  config.include Devise::TestHelpers, type: :controller
-  config.include Devise::TestHelpers, type: :view
 end
 ```

@@ -442,7 +433,7 @@ sign_out @user         # sign_out(resource)

 There are two things that are important to keep in mind:

-1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. It is undesirable even to include `Devise::TestHelpers` during integration tests. Instead, fill in the form or explicitly set the user in session;
+1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. Instead, fill in the form or explicitly set the user in session;

 2. If you are testing Devise internal controllers or a controller that inherits from Devise's, you need to tell Devise which mapping should be used before a request. This is necessary because Devise gets this information from the router, but since functional tests do not pass through the router, it needs to be stated explicitly. For example, if you are testing the user scope, simply use:

@@ -486,7 +477,7 @@ devise :database_authenticatable, :timeoutable
 devise_for :admins

 # Inside your protected controller
-before_action :authenticate_admin!
+before_filter :authenticate_admin!

 # Inside your controllers and views
 admin_signed_in?
@@ -554,6 +545,6 @@ https://github.com/plataformatec/devise/graphs/contributors

 ## License

-MIT License. Copyright 2009-2016 Plataformatec. http://plataformatec.com.br
+MIT License. Copyright 2009-2015 Plataformatec. http://plataformatec.com.br

 You are not granted rights or licenses to the trademarks of Plataformatec, including without limitation the Devise name or logo.
--- a/app/controllers/devise/confirmations_controller.rb
+++ b/app/controllers/devise/confirmations_controller.rb
@@ -22,7 +22,7 @@ class Devise::ConfirmationsController < DeviseController
    yield resource if block_given?

    if resource.errors.empty?
-      set_flash_message!(:notice, :confirmed)
+      set_flash_message(:notice, :confirmed) if is_flashing_format?
      respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
    else
      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
--- a/app/controllers/devise/omniauth_callbacks_controller.rb
+++ b/app/controllers/devise/omniauth_callbacks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::OmniauthCallbacksController < DeviseController
-  prepend_before_action { request.env["devise.skip_timeout"] = true }
+  prepend_before_filter { request.env["devise.skip_timeout"] = true }

  def passthru
    render status: 404, text: "Not found. Authentication passthru."
@@ -13,14 +13,14 @@ class Devise::OmniauthCallbacksController < DeviseController
  protected

  def failed_strategy
-    request.respond_to?(:get_header) ? request.get_header("omniauth.error.strategy") : env["omniauth.error.strategy"]
+    env["omniauth.error.strategy"]
  end

  def failure_message
-    exception = request.respond_to?(:get_header) ? request.get_header("omniauth.error") : env["omniauth.error"]
+    exception = env["omniauth.error"]
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
-    error ||= (request.respond_to?(:get_header) ? request.get_header("omniauth.error.type") : env["omniauth.error.type"]).to_s
+    error ||= env["omniauth.error.type"].to_s
    error.to_s.humanize if error
  end

--- a/app/controllers/devise/passwords_controller.rb
+++ b/app/controllers/devise/passwords_controller.rb
@@ -1,7 +1,7 @@
 class Devise::PasswordsController < DeviseController
-  prepend_before_action :require_no_authentication
+  prepend_before_filter :require_no_authentication
  # Render the #edit only if coming from a reset password email link
-  append_before_action :assert_reset_token_passed, only: :edit
+  append_before_filter :assert_reset_token_passed, only: :edit

  # GET /resource/password/new
  def new
@@ -36,10 +36,10 @@ class Devise::PasswordsController < DeviseController
      resource.unlock_access! if unlockable?(resource)
      if Devise.sign_in_after_reset_password
        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-        set_flash_message!(:notice, flash_message)
+        set_flash_message(:notice, flash_message) if is_flashing_format?
        sign_in(resource_name, resource)
      else
-        set_flash_message!(:notice, :updated_not_active)
+        set_flash_message(:notice, :updated_not_active) if is_flashing_format?
      end
      respond_with resource, location: after_resetting_password_path_for(resource)
    else
--- a/app/controllers/devise/registrations_controller.rb
+++ b/app/controllers/devise/registrations_controller.rb
@@ -1,6 +1,6 @@
 class Devise::RegistrationsController < DeviseController
-  prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
-  prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]
+  prepend_before_filter :require_no_authentication, only: [:new, :create, :cancel]
+  prepend_before_filter :authenticate_scope!, only: [:edit, :update, :destroy]

  # GET /resource/sign_up
  def new
@@ -18,11 +18,11 @@ class Devise::RegistrationsController < DeviseController
    yield resource if block_given?
    if resource.persisted?
      if resource.active_for_authentication?
-        set_flash_message! :notice, :signed_up
+        set_flash_message :notice, :signed_up if is_flashing_format?
        sign_up(resource_name, resource)
        respond_with resource, location: after_sign_up_path_for(resource)
      else
-        set_flash_message! :notice, :"signed_up_but_#{resource.inactive_message}"
+        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
        expire_data_after_sign_in!
        respond_with resource, location: after_inactive_sign_up_path_for(resource)
      end
@@ -65,7 +65,7 @@ class Devise::RegistrationsController < DeviseController
  def destroy
    resource.destroy
    Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
-    set_flash_message! :notice, :destroyed
+    set_flash_message :notice, :destroyed if is_flashing_format?
    yield resource if block_given?
    respond_with_navigational(resource){ redirect_to after_sign_out_path_for(resource_name) }
  end
--- a/app/controllers/devise/sessions_controller.rb
+++ b/app/controllers/devise/sessions_controller.rb
@@ -1,8 +1,8 @@
 class Devise::SessionsController < DeviseController
-  prepend_before_action :require_no_authentication, only: [:new, :create]
-  prepend_before_action :allow_params_authentication!, only: :create
-  prepend_before_action :verify_signed_out_user, only: :destroy
-  prepend_before_action only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }
+  prepend_before_filter :require_no_authentication, only: [:new, :create]
+  prepend_before_filter :allow_params_authentication!, only: :create
+  prepend_before_filter :verify_signed_out_user, only: :destroy
+  prepend_before_filter only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }

  # GET /resource/sign_in
  def new
@@ -15,7 +15,7 @@ class Devise::SessionsController < DeviseController
  # POST /resource/sign_in
  def create
    self.resource = warden.authenticate!(auth_options)
-    set_flash_message!(:notice, :signed_in)
+    set_flash_message(:notice, :signed_in) if is_flashing_format?
    sign_in(resource_name, resource)
    yield resource if block_given?
    respond_with resource, location: after_sign_in_path_for(resource)
@@ -24,7 +24,7 @@ class Devise::SessionsController < DeviseController
  # DELETE /resource/sign_out
  def destroy
    signed_out = (Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name))
-    set_flash_message! :notice, :signed_out if signed_out
+    set_flash_message :notice, :signed_out if signed_out && is_flashing_format?
    yield if block_given?
    respond_to_on_destroy
  end
@@ -58,7 +58,7 @@ class Devise::SessionsController < DeviseController
  # to the after_sign_out path.
  def verify_signed_out_user
    if all_signed_out?
-      set_flash_message! :notice, :already_signed_out
+      set_flash_message :notice, :already_signed_out if is_flashing_format?

      respond_to_on_destroy
    end
--- a/app/controllers/devise/unlocks_controller.rb
+++ b/app/controllers/devise/unlocks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::UnlocksController < DeviseController
-  prepend_before_action :require_no_authentication
+  prepend_before_filter :require_no_authentication

  # GET /resource/unlock/new
  def new
@@ -24,7 +24,7 @@ class Devise::UnlocksController < DeviseController
    yield resource if block_given?

    if resource.errors.empty?
-      set_flash_message! :notice, :unlocked
+      set_flash_message :notice, :unlocked if is_flashing_format?
      respond_with_navigational(resource){ redirect_to after_unlock_path_for(resource) }
    else
      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
--- a/app/controllers/devise_controller.rb
+++ b/app/controllers/devise_controller.rb
@@ -2,17 +2,13 @@
 class DeviseController < Devise.parent_controller.constantize
  include Devise::Controllers::ScopedViews

-  if respond_to?(:helper)
-    helper DeviseHelper
-  end
+  helper DeviseHelper

-  if respond_to?(:helper_method)
-    helpers = %w(resource scope_name resource_name signed_in_resource
-                 resource_class resource_params devise_mapping)
-    helper_method(*helpers)
-  end
+  helpers = %w(resource scope_name resource_name signed_in_resource
+               resource_class resource_params devise_mapping)
+  helper_method(*helpers)

-  prepend_before_action :assert_is_devise_resource!
+  prepend_before_filter :assert_is_devise_resource!
  respond_to :html if mimes_for_respond_to.empty?

  # Override prefixes to consider the scoped view.
@@ -93,10 +89,10 @@ MESSAGE
    instance_variable_set(:"@#{resource_name}", new_resource)
  end

-  # Helper for use in before_actions where no authentication is required.
+  # Helper for use in before_filters where no authentication is required.
  #
  # Example:
-  #   before_action :require_no_authentication, only: :new
+  #   before_filter :require_no_authentication, only: :new
  def require_no_authentication
    assert_is_devise_resource!
    return unless is_navigational_format?
@@ -127,13 +123,13 @@ MESSAGE
    end

    if notice
-      set_flash_message! :notice, notice
+      set_flash_message :notice, notice if is_flashing_format?
      true
    end
  end

  # Sets the flash message with :key, using I18n. By default you are able
-  # to set up your messages using specific resource scope, and if no message is
+  # to setup your messages using specific resource scope, and if no message is
  # found we look to the default scope. Set the "now" options key to a true
  # value to populate the flash.now hash in lieu of the default flash hash (so
  # the flash message will be available to the current action instead of the
@@ -158,13 +154,6 @@ MESSAGE
    end
  end

-  # Sets flash message if is_flashing_format? equals true
-  def set_flash_message!(key, kind, options = {})
-    if is_flashing_format?
-      set_flash_message(key, kind, options)
-    end
-  end
-
  # Sets minimum password length to show to user
  def set_minimum_password_length
    if devise_mapping.validatable?
--- a/app/views/devise/confirmations/new.html.erb
+++ b/app/views/devise/confirmations/new.html.erb
@@ -5,7 +5,7 @@

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %>
+    <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %> 
  </div>

  <div class="actions">
--- a/bin/test
+++ b/bin/test
@@ -1,13 +0,0 @@
-#!/usr/bin/env ruby
-$: << File.expand_path(File.expand_path('../../test', __FILE__))
-
-require 'bundler/setup'
-begin
-  require 'rails/test_unit/minitest_plugin'
-rescue LoadError
-  exec 'rake'
-end
-
-Rails::TestUnitReporter.executable = 'bin/test'
-
-exit Minitest.run(ARGV)
--- a/devise.gemspec
+++ b/devise.gemspec
@@ -16,11 +16,12 @@ Gem::Specification.new do |s|
  s.files         = `git ls-files`.split("\n")
  s.test_files    = `git ls-files -- test/*`.split("\n")
  s.require_paths = ["lib"]
-  s.required_ruby_version = '>= 2.1.0'
+  s.required_ruby_version = '>= 1.9.3'

  s.add_dependency("warden", "~> 1.2.3")
  s.add_dependency("orm_adapter", "~> 0.1")
  s.add_dependency("bcrypt", "~> 3.0")
-  s.add_dependency("railties", ">= 4.1.0", "< 5.1")
+  s.add_dependency("thread_safe", "~> 0.1")
+  s.add_dependency("railties", ">= 3.2.6", "< 5")
  s.add_dependency("responders")
 end
--- a/gemfiles/Gemfile.rails-3.2-stable
+++ b/gemfiles/Gemfile.rails-3.2-stable
@@ -1,19 +1,12 @@
 source "https://rubygems.org"

-gemspec path: ".."
+gemspec path: '..'

-gem "rails", "5.0.0.beta3"
-gem "omniauth", " ~>1.3"
-gem "oauth2"
-gem "omniauth-oauth2", ">= 1.2.0", "< 1.5.0"
+gem "rails", github: 'rails/rails', branch: '3-2-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"

-gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
-
-gem "rails-controller-testing"
-
-gem "responders", "~> 2.1.1"
-
 group :test do
  gem "omniauth-facebook"
  gem "omniauth-openid", "~> 1.0.1"
@@ -31,7 +24,6 @@ platforms :ruby do
  gem "sqlite3"
 end

-# TODO:
-# group :mongoid do
-#   gem "mongoid", "~> 4.0.0"
-# end
+group :mongoid do
+  gem "mongoid", "~> 3.0"
+end
--- a/gemfiles/Gemfile.rails-3.2-stable.lock
+++ b/gemfiles/Gemfile.rails-3.2-stable.lock
@@ -0,0 +1,172 @@
+GIT
+  remote: git://github.com/rails/rails.git
+  revision: b344986bc3d94ca7821fc5e0eef1874882ac6cbb
+  branch: 3-2-stable
+  specs:
+    actionmailer (3.2.21)
+      actionpack (= 3.2.21)
+      mail (~> 2.5.4)
+    actionpack (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      journey (~> 1.0.4)
+      rack (~> 1.4.5)
+      rack-cache (~> 1.2)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.2.1)
+    activemodel (3.2.21)
+      activesupport (= 3.2.21)
+      builder (~> 3.0.0)
+    activerecord (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+      arel (~> 3.0.2)
+      tzinfo (~> 0.3.29)
+    activeresource (3.2.21)
+      activemodel (= 3.2.21)
+      activesupport (= 3.2.21)
+    activesupport (3.2.21)
+      i18n (~> 0.6, >= 0.6.4)
+      multi_json (~> 1.0)
+    rails (3.2.21)
+      actionmailer (= 3.2.21)
+      actionpack (= 3.2.21)
+      activerecord (= 3.2.21)
+      activeresource (= 3.2.21)
+      activesupport (= 3.2.21)
+      bundler (~> 1.0)
+      railties (= 3.2.21)
+    railties (3.2.21)
+      actionpack (= 3.2.21)
+      activesupport (= 3.2.21)
+      rack-ssl (~> 1.3.2)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (>= 0.14.6, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.3)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    arel (3.0.3)
+    bcrypt (3.1.10)
+    builder (3.0.4)
+    erubis (2.7.0)
+    faraday (0.9.1)
+      multipart-post (>= 1.2, < 3)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    journey (1.0.4)
+    json (1.8.2)
+    jwt (1.4.1)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    metaclass (0.0.4)
+    mime-types (1.25.1)
+    mini_portile (0.6.2)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    mongoid (3.1.6)
+      activemodel (~> 3.2)
+      moped (~> 1.4)
+      origin (~> 1.0)
+      tzinfo (~> 0.3.29)
+    moped (1.5.2)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    origin (1.1.0)
+    orm_adapter (0.5.0)
+    polyglot (0.3.5)
+    rack (1.4.5)
+    rack-cache (1.2)
+      rack (>= 0.4)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-ssl (1.3.4)
+      rack
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rake (10.4.2)
+    rdoc (3.12.2)
+      json (~> 1.4)
+    responders (1.1.2)
+      railties (>= 3.2, < 4.2)
+    ruby-openid (2.7.0)
+    sprockets (2.2.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.43)
+    warden (1.2.4)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  mongoid (~> 3.0)
+  omniauth (~> 1.2.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
+  rails!
+  rdoc
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.0-stable
+++ b/gemfiles/Gemfile.rails-4.0-stable
@@ -0,0 +1,29 @@
+source "https://rubygems.org"
+
+gemspec path: '..'
+
+gem "rails", github: 'rails/rails', branch: '4-0-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
+gem "rdoc"
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
+  gem "webrat", "0.7.3", require: false
+  gem "mocha", "~> 1.1", require: false
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3"
+end
+
+group :mongoid do
+  gem "mongoid", "~> 4.0.0"
+end
--- a/gemfiles/Gemfile.rails-4.0-stable.lock
+++ b/gemfiles/Gemfile.rails-4.0-stable.lock
@@ -0,0 +1,166 @@
+GIT
+  remote: git://github.com/rails/rails.git
+  revision: 7ec9c9635bf4d57009135ed11e89d8bf32306d73
+  branch: 4-0-stable
+  specs:
+    actionmailer (4.0.13)
+      actionpack (= 4.0.13)
+      mail (~> 2.5, >= 2.5.4)
+    actionpack (4.0.13)
+      activesupport (= 4.0.13)
+      builder (~> 3.1.0)
+      erubis (~> 2.7.0)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    activemodel (4.0.13)
+      activesupport (= 4.0.13)
+      builder (~> 3.1.0)
+    activerecord (4.0.13)
+      activemodel (= 4.0.13)
+      activerecord-deprecated_finders (~> 1.0.2)
+      activesupport (= 4.0.13)
+      arel (~> 4.0.0)
+    activesupport (4.0.13)
+      i18n (~> 0.6, >= 0.6.9)
+      minitest (~> 4.2)
+      multi_json (~> 1.3)
+      thread_safe (~> 0.1)
+      tzinfo (~> 0.3.37)
+    rails (4.0.13)
+      actionmailer (= 4.0.13)
+      actionpack (= 4.0.13)
+      activerecord (= 4.0.13)
+      activesupport (= 4.0.13)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.0.13)
+      sprockets-rails (~> 2.0)
+    railties (4.0.13)
+      actionpack (= 4.0.13)
+      activesupport (= 4.0.13)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.3)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activerecord-deprecated_finders (1.0.3)
+    arel (4.0.2)
+    bcrypt (3.1.10)
+    bson (2.3.0)
+    builder (3.1.4)
+    connection_pool (2.1.3)
+    erubis (2.7.0)
+    faraday (0.9.1)
+      multipart-post (>= 1.2, < 3)
+    hashie (3.4.0)
+    hike (1.2.3)
+    i18n (0.7.0)
+    jwt (1.4.1)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    metaclass (0.0.4)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (4.7.5)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    mongoid (4.0.2)
+      activemodel (~> 4.0)
+      moped (~> 2.0.0)
+      origin (~> 2.1)
+      tzinfo (>= 0.3.37)
+    moped (2.0.4)
+      bson (~> 2.2)
+      connection_pool (~> 2.0)
+      optionable (~> 0.2.0)
+    multi_json (1.11.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (~> 1.2)
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    optionable (0.2.0)
+    origin (2.1.1)
+    orm_adapter (0.5.0)
+    rack (1.5.2)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (1.1.2)
+      railties (>= 3.2, < 4.2)
+    ruby-openid (2.7.0)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (1.4.1)
+    tzinfo (0.3.43)
+    warden (1.2.4)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  mongoid (~> 4.0.0)
+  omniauth (~> 1.2.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.1.0)
+  omniauth-openid (~> 1.0.1)
+  rails!
+  rdoc
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.1-stable
+++ b/gemfiles/Gemfile.rails-4.1-stable
@@ -1,10 +1,10 @@
 source "https://rubygems.org"

-gemspec path: ".."
+gemspec path: '..'

-gem "rails", github: "rails/rails", branch: "4-1-stable"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "rails", github: 'rails/rails', branch: '4-1-stable'
+gem "omniauth", "~> 1.2.0"
+gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"

 group :test do
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -1,82 +1,83 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: 41b4d81b4fd14cbf43060c223bea0f461256d099
+  revision: bf32ec7b8611e6b4c7e9398f7d297a1f0221e9b9
  branch: 4-1-stable
  specs:
-    actionmailer (4.1.15)
-      actionpack (= 4.1.15)
-      actionview (= 4.1.15)
+    actionmailer (4.1.10)
+      actionpack (= 4.1.10)
+      actionview (= 4.1.10)
      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.15)
-      actionview (= 4.1.15)
-      activesupport (= 4.1.15)
+    actionpack (4.1.10)
+      actionview (= 4.1.10)
+      activesupport (= 4.1.10)
      rack (~> 1.5.2)
      rack-test (~> 0.6.2)
-    actionview (4.1.15)
-      activesupport (= 4.1.15)
+    actionview (4.1.10)
+      activesupport (= 4.1.10)
      builder (~> 3.1)
      erubis (~> 2.7.0)
-    activemodel (4.1.15)
-      activesupport (= 4.1.15)
+    activemodel (4.1.10)
+      activesupport (= 4.1.10)
      builder (~> 3.1)
-    activerecord (4.1.15)
-      activemodel (= 4.1.15)
-      activesupport (= 4.1.15)
+    activerecord (4.1.10)
+      activemodel (= 4.1.10)
+      activesupport (= 4.1.10)
      arel (~> 5.0.0)
-    activesupport (4.1.15)
+    activesupport (4.1.10)
      i18n (~> 0.6, >= 0.6.9)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.1)
      tzinfo (~> 1.1)
-    rails (4.1.15)
-      actionmailer (= 4.1.15)
-      actionpack (= 4.1.15)
-      actionview (= 4.1.15)
-      activemodel (= 4.1.15)
-      activerecord (= 4.1.15)
-      activesupport (= 4.1.15)
+    rails (4.1.10)
+      actionmailer (= 4.1.10)
+      actionpack (= 4.1.10)
+      actionview (= 4.1.10)
+      activemodel (= 4.1.10)
+      activerecord (= 4.1.10)
+      activesupport (= 4.1.10)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.15)
+      railties (= 4.1.10)
      sprockets-rails (~> 2.0)
-    railties (4.1.15)
-      actionpack (= 4.1.15)
-      activesupport (= 4.1.15)
+    railties (4.1.10)
+      actionpack (= 4.1.10)
+      activesupport (= 4.1.10)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (4.0.0.rc2)
+    devise (3.5.3)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.1)
+      railties (>= 3.2.6, < 5)
      responders
+      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
    arel (5.0.1.20140414130214)
-    bcrypt (3.1.11)
-    bson (3.2.6)
+    bcrypt (3.1.10)
+    bson (2.3.0)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
-    connection_pool (2.2.0)
+    connection_pool (2.1.3)
    erubis (2.7.0)
-    faraday (0.9.2)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    hashie (3.4.3)
+    hashie (3.4.0)
+    hike (1.2.3)
    i18n (0.7.0)
-    json (1.8.3)
-    jwt (1.5.1)
+    json (1.8.2)
+    jwt (1.4.1)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.99.1)
-    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (5.5.1)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -84,60 +85,64 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.7)
-      bson (~> 3.0)
+    moped (2.0.4)
+      bson (~> 2.2)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.11.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.1.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
+      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.3.1)
+      rack (~> 1.2)
+    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
-      rack (>= 1.0, < 3)
-    omniauth-facebook (3.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
+      rack (~> 1.0)
+    omniauth-facebook (1.6.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-oauth2 (1.1.2)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 0.9.3)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.2.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (1.5.5)
+    rack (1.5.2)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (11.0.1)
-    rdoc (4.2.2)
-      json (~> 1.4)
+    rake (10.4.2)
+    rdoc (4.2.0)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (2.3.3)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
      actionpack (>= 3.0)
      activesupport (>= 3.0)
      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.11)
+    sqlite3 (1.3.10)
    thor (0.19.1)
    thread_safe (0.3.5)
+    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.6)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -154,9 +159,9 @@ DEPENDENCIES
  jruby-openssl
  mocha (~> 1.1)
  mongoid (~> 4.0.0)
-  omniauth (~> 1.3)
+  omniauth (~> 1.2.0)
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
+  omniauth-oauth2 (~> 1.1.0)
  omniauth-openid (~> 1.0.1)
  rails!
  rdoc
@@ -164,4 +169,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.11.2
+   1.10.6
--- a/gemfiles/Gemfile.rails-4.2-stable
+++ b/gemfiles/Gemfile.rails-4.2-stable
@@ -1,10 +1,10 @@
 source "https://rubygems.org"

-gemspec path: ".."
+gemspec path: '..'

-gem "rails", github: "rails/rails", branch: "4-2-stable"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "rails", github: 'rails/rails', branch: '4-2-stable'
+gem "omniauth", "~> 1.2.2"
+gem "omniauth-oauth2", "~> 1.2.0"
 gem "rdoc"

 group :test do
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,96 +1,97 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: 2aa27582c202148296bb169159b0bf9a47a7bd80
+  revision: f12ff8ddab7b199707ec36d72bd72f206f142c8b
  branch: 4-2-stable
  specs:
-    actionmailer (4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
+    actionmailer (4.2.1)
+      actionpack (= 4.2.1)
+      actionview (= 4.2.1)
+      activejob (= 4.2.1)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.6)
-      actionview (= 4.2.6)
-      activesupport (= 4.2.6)
+    actionpack (4.2.1)
+      actionview (= 4.2.1)
+      activesupport (= 4.2.1)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.6)
-      activesupport (= 4.2.6)
+    actionview (4.2.1)
+      activesupport (= 4.2.1)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.6)
-      activesupport (= 4.2.6)
+    activejob (4.2.1)
+      activesupport (= 4.2.1)
      globalid (>= 0.3.0)
-    activemodel (4.2.6)
-      activesupport (= 4.2.6)
+    activemodel (4.2.1)
+      activesupport (= 4.2.1)
      builder (~> 3.1)
-    activerecord (4.2.6)
-      activemodel (= 4.2.6)
-      activesupport (= 4.2.6)
+    activerecord (4.2.1)
+      activemodel (= 4.2.1)
+      activesupport (= 4.2.1)
      arel (~> 6.0)
-    activesupport (4.2.6)
+    activesupport (4.2.1)
      i18n (~> 0.7)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    rails (4.2.6)
-      actionmailer (= 4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
-      activemodel (= 4.2.6)
-      activerecord (= 4.2.6)
-      activesupport (= 4.2.6)
+    rails (4.2.1)
+      actionmailer (= 4.2.1)
+      actionpack (= 4.2.1)
+      actionview (= 4.2.1)
+      activejob (= 4.2.1)
+      activemodel (= 4.2.1)
+      activerecord (= 4.2.1)
+      activesupport (= 4.2.1)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.6)
+      railties (= 4.2.1)
      sprockets-rails
-    railties (4.2.6)
-      actionpack (= 4.2.6)
-      activesupport (= 4.2.6)
+    railties (4.2.1)
+      actionpack (= 4.2.1)
+      activesupport (= 4.2.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (4.0.0.rc2)
+    devise (3.5.3)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.1)
+      railties (>= 3.2.6, < 5)
      responders
+      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
-    arel (6.0.3)
-    bcrypt (3.1.11)
-    bson (3.2.6)
+    arel (6.0.0)
+    bcrypt (3.1.10)
+    bson (2.3.0)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
-    connection_pool (2.2.0)
+    connection_pool (2.1.3)
    erubis (2.7.0)
-    faraday (0.9.2)
+    faraday (0.9.1)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.6)
+    globalid (0.3.3)
      activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.0)
+    hike (1.2.3)
    i18n (0.7.0)
-    json (1.8.3)
-    jwt (1.5.1)
-    loofah (2.0.3)
+    json (1.8.2)
+    jwt (1.4.1)
+    loofah (2.0.1)
      nokogiri (>= 1.5.9)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.99.1)
-    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    mime-types (2.4.3)
+    mini_portile (0.6.2)
+    minitest (5.5.1)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -98,36 +99,38 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.7)
-      bson (~> 3.0)
+    moped (2.0.4)
+      bson (~> 2.2)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.11.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.1.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    oauth2 (1.0.0)
      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
+      jwt (~> 1.0)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.3.1)
+      rack (~> 1.2)
+    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
-      rack (>= 1.0, < 3)
-    omniauth-facebook (3.0.0)
+      rack (~> 1.0)
+    omniauth-facebook (2.0.1)
      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
+    omniauth-oauth2 (1.2.0)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
      oauth2 (~> 1.0)
      omniauth (~> 1.2)
    omniauth-openid (1.0.1)
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.2.0)
+    origin (2.1.1)
    orm_adapter (0.5.0)
-    rack (1.6.4)
+    rack (1.6.0)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -135,31 +138,33 @@ GEM
      rack (>= 1.0)
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
+    rails-dom-testing (1.0.6)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
+    rails-html-sanitizer (1.0.2)
      loofah (~> 2.0)
-    rake (11.0.1)
-    rdoc (4.2.2)
-      json (~> 1.4)
-    responders (2.1.1)
-      railties (>= 4.2.0, < 5.1)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    responders (2.1.0)
+      railties (>= 4.2.0, < 5)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.0.4)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.11)
+    sprockets (2.12.3)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.2.4)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (>= 2.8, < 4.0)
+    sqlite3 (1.3.10)
    thor (0.19.1)
    thread_safe (0.3.5)
+    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.6)
+    warden (1.2.4)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -176,9 +181,9 @@ DEPENDENCIES
  jruby-openssl
  mocha (~> 1.1)
  mongoid (~> 4.0.0)
-  omniauth (~> 1.3)
+  omniauth (~> 1.2.2)
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
+  omniauth-oauth2 (~> 1.2.0)
  omniauth-openid (~> 1.0.1)
  rails!
  rdoc
@@ -186,4 +191,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.11.2
+   1.10.6
--- a/gemfiles/Gemfile.rails-5.0-beta.lock
+++ b/gemfiles/Gemfile.rails-5.0-beta.lock
@@ -1,199 +0,0 @@
-GIT
-  remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: f380ea5ddefcb9a37f4fbc47606ed6fbecdb2b2a
-  specs:
-    activemodel-serializers-xml (1.0.0)
-      activemodel (> 5.x)
-      activerecord (> 5.x)
-      activesupport (> 5.x)
-      builder (~> 3.1)
-
-PATH
-  remote: ..
-  specs:
-    devise (4.0.0.rc2)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.1)
-      responders
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (5.0.0.beta3)
-      actionpack (= 5.0.0.beta3)
-      nio4r (~> 1.2)
-      websocket-driver (~> 0.6.1)
-    actionmailer (5.0.0.beta3)
-      actionpack (= 5.0.0.beta3)
-      actionview (= 5.0.0.beta3)
-      activejob (= 5.0.0.beta3)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (5.0.0.beta3)
-      actionview (= 5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      rack (~> 2.x)
-      rack-test (~> 0.6.3)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      builder (~> 3.1)
-      erubis (~> 2.7.0)
-      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      globalid (>= 0.3.6)
-    activemodel (5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-    activerecord (5.0.0.beta3)
-      activemodel (= 5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      arel (~> 7.0)
-    activesupport (5.0.0.beta3)
-      concurrent-ruby (~> 1.0)
-      i18n (~> 0.7)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    arel (7.0.0)
-    bcrypt (3.1.11)
-    builder (3.2.2)
-    concurrent-ruby (1.0.1)
-    erubis (2.7.0)
-    faraday (0.9.2)
-      multipart-post (>= 1.2, < 3)
-    globalid (0.3.6)
-      activesupport (>= 4.1.0)
-    hashie (3.4.3)
-    i18n (0.7.0)
-    json (1.8.3)
-    jwt (1.5.1)
-    loofah (2.0.3)
-      nokogiri (>= 1.5.9)
-    mail (2.6.4)
-      mime-types (>= 1.16, < 4)
-    metaclass (0.0.4)
-    method_source (0.8.2)
-    mime-types (3.0)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0221)
-    mini_portile2 (2.0.0)
-    minitest (5.8.4)
-    mocha (1.1.0)
-      metaclass (~> 0.0.1)
-    multi_json (1.11.2)
-    multi_xml (0.5.5)
-    multipart-post (2.0.0)
-    nio4r (1.2.1)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.1.0)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    omniauth (1.3.1)
-      hashie (>= 1.2, < 4)
-      rack (>= 1.0, < 3)
-    omniauth-facebook (3.0.0)
-      omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.4.0)
-      oauth2 (~> 1.0)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    orm_adapter (0.5.0)
-    rack (2.0.0.alpha)
-      json
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rails (5.0.0.beta3)
-      actioncable (= 5.0.0.beta3)
-      actionmailer (= 5.0.0.beta3)
-      actionpack (= 5.0.0.beta3)
-      actionview (= 5.0.0.beta3)
-      activejob (= 5.0.0.beta3)
-      activemodel (= 5.0.0.beta3)
-      activerecord (= 5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 5.0.0.beta3)
-      sprockets-rails (>= 2.0.0)
-    rails-controller-testing (0.1.1)
-      actionpack (~> 5.x)
-      actionview (~> 5.x)
-      activesupport (~> 5.x)
-    rails-deprecated_sanitizer (1.0.3)
-      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
-      activesupport (>= 4.2.0.beta, < 5.0)
-      nokogiri (~> 1.6.0)
-      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
-    railties (5.0.0.beta3)
-      actionpack (= 5.0.0.beta3)
-      activesupport (= 5.0.0.beta3)
-      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-    rake (11.1.2)
-    rdoc (4.2.2)
-      json (~> 1.4)
-    responders (2.1.2)
-      railties (>= 4.2.0, < 5.1)
-    ruby-openid (2.7.0)
-    sprockets (3.6.0)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.0.4)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.3.11)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tzinfo (1.2.2)
-      thread_safe (~> 0.1)
-    warden (1.2.6)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-    websocket-driver (0.6.3)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activemodel-serializers-xml!
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  devise!
-  jruby-openssl
-  mocha (~> 1.1)
-  oauth2
-  omniauth (~> 1.3)
-  omniauth-facebook
-  omniauth-oauth2 (>= 1.2.0, < 1.5.0)
-  omniauth-openid (~> 1.0.1)
-  rails (= 5.0.0.beta3)
-  rails-controller-testing
-  rdoc
-  responders (~> 2.1.1)
-  sqlite3
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.11.2
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -12,18 +12,19 @@ module Devise
  autoload :FailureApp,         'devise/failure_app'
  autoload :OmniAuth,           'devise/omniauth'
  autoload :ParameterFilter,    'devise/parameter_filter'
+  autoload :BaseSanitizer,      'devise/parameter_sanitizer'
  autoload :ParameterSanitizer, 'devise/parameter_sanitizer'
  autoload :TestHelpers,        'devise/test_helpers'
  autoload :TimeInflector,      'devise/time_inflector'
  autoload :TokenGenerator,     'devise/token_generator'

  module Controllers
-    autoload :Helpers,        'devise/controllers/helpers'
-    autoload :Rememberable,   'devise/controllers/rememberable'
-    autoload :ScopedViews,    'devise/controllers/scoped_views'
-    autoload :SignInOut,      'devise/controllers/sign_in_out'
-    autoload :StoreLocation,  'devise/controllers/store_location'
-    autoload :UrlHelpers,     'devise/controllers/url_helpers'
+    autoload :Helpers, 'devise/controllers/helpers'
+    autoload :Rememberable, 'devise/controllers/rememberable'
+    autoload :ScopedViews, 'devise/controllers/scoped_views'
+    autoload :SignInOut, 'devise/controllers/sign_in_out'
+    autoload :StoreLocation, 'devise/controllers/store_location'
+    autoload :UrlHelpers, 'devise/controllers/url_helpers'
  end

  module Hooks
@@ -35,7 +36,7 @@ module Devise
  end

  module Strategies
-    autoload :Base,            'devise/strategies/base'
+    autoload :Base, 'devise/strategies/base'
    autoload :Authenticatable, 'devise/strategies/authenticatable'
  end

@@ -53,12 +54,6 @@ module Devise
  # True values used to check params
  TRUE_VALUES = [true, 1, '1', 't', 'T', 'true', 'TRUE']

-  # Track the configs that user explicit changed the default value. It is
-  # helpfull to not warn users about default values changing when they willing
-  # changed.
-  mattr_accessor :app_set_configs
-  @@app_set_configs = Set.new
-
  # Secret key used by the key generator
  mattr_accessor :secret_key
  @@secret_key = nil
@@ -67,9 +62,9 @@ module Devise
  mattr_accessor :rememberable_options
  @@rememberable_options = {}

-  # The number of times to hash the password.
+  # The number of times to encrypt password.
  mattr_accessor :stretches
-  @@stretches = 11
+  @@stretches = 10

  # The default key used when authenticating over http auth.
  mattr_accessor :http_authentication_key
@@ -88,20 +83,9 @@ module Devise
  @@case_insensitive_keys = [:email]

  # Keys that should have whitespace stripped.
-  # TODO: 4.1 Do: @@strip_whitespace_keys = [:email]
-  mattr_reader :strip_whitespace_keys
+  mattr_accessor :strip_whitespace_keys
  @@strip_whitespace_keys = []

-  def self.strip_whitespace_keys=(strip_whitespace_keys)
-    app_set_configs << :strip_whitespace_keys
-    @@strip_whitespace_keys = strip_whitespace_keys
-  end
-
-  def strip_whitespace_keys=(strip_whitespace_keys)
-    app_set_configs << :strip_whitespace_keys
-    @@strip_whitespace_keys = strip_whitespace_keys
-  end
-
  # If http authentication is enabled by default.
  mattr_accessor :http_authenticatable
  @@http_authenticatable = false
@@ -121,20 +105,9 @@ module Devise
  # Email regex used to validate email formats. It simply asserts that
  # an one (and only one) @ exists in the given string. This is mainly
  # to give user feedback and not to assert the e-mail validity.
-  # TODO: 4.1 Do: @@email_regexp = [/\A[^@\s]+@[^@\s]+\z/]
-  mattr_reader :email_regexp
+  mattr_accessor :email_regexp
  @@email_regexp = /\A[^@\s]+@([^@\s]+\.)+[^@\W]+\z/

-  def self.email_regexp=(email_regexp)
-    app_set_configs << :email_regexp
-    @@email_regexp = email_regexp
-  end
-
-  def email_regexp=(email_regexp)
-    app_set_configs << :email_regexp
-    @@email_regexp = email_regexp
-  end
-
  # Range validation for password length
  mattr_accessor :password_length
  @@password_length = 6..128
@@ -143,6 +116,7 @@ module Devise
  mattr_accessor :remember_for
  @@remember_for = 2.weeks

+  # TODO: extend_remember_period is no longer used
  # If true, extends the user's remember period when remembered via cookie.
  mattr_accessor :extend_remember_period
  @@extend_remember_period = false
@@ -166,25 +140,14 @@ module Devise

  # Defines if email should be reconfirmable.
  # False by default for backwards compatibility.
-  # TODO: 4.1 Do: @@reconfirmable = true
-  mattr_reader :reconfirmable
+  mattr_accessor :reconfirmable
  @@reconfirmable = false

-  def self.reconfirmable=(reconfirmable)
-    app_set_configs << :reconfirmable
-    @@reconfirmable = reconfirmable
-  end
-
-  def reconfirmable=(reconfirmable)
-    app_set_configs << :reconfirmable
-    @@reconfirmable = reconfirmable
-  end
-
  # Time interval to timeout the user session without activity.
  mattr_accessor :timeout_in
  @@timeout_in = 30.minutes

-  # Used to hash the password. Please generate one with rake secret.
+  # Used to encrypt password. Please generate one with rake secret.
  mattr_accessor :pepper
  @@pepper = nil

@@ -240,20 +203,9 @@ module Devise
  @@mailer_sender = nil

  # Skip session storage for the following strategies
-  # TODO: 4.1 Do: @@skip_session_storage = [:http_auth]
-  mattr_reader :skip_session_storage
+  mattr_accessor :skip_session_storage
  @@skip_session_storage = []

-  def self.skip_session_storage=(skip_session_storage)
-    app_set_configs << :skip_session_storage
-    @@skip_session_storage = skip_session_storage
-  end
-
-  def skip_session_storage=(skip_session_storage)
-    app_set_configs << :skip_session_storage
-    @@skip_session_storage = skip_session_storage
-  end
-
  # Which formats should be treated as navigational.
  mattr_accessor :navigational_formats
  @@navigational_formats = ["*/*", :html]
@@ -263,20 +215,9 @@ module Devise
  @@sign_out_all_scopes = true

  # The default method used while signing out
-  # TODO: 4.1 Do: @@sign_out_via = :delete
-  mattr_reader :sign_out_via
+  mattr_accessor :sign_out_via
  @@sign_out_via = :get

-  def self.sign_out_via=(sign_out_via)
-    app_set_configs << :sign_out_via
-    @@sign_out_via = sign_out_via
-  end
-
-  def sign_out_via=(sign_out_via)
-    app_set_configs << :sign_out_via
-    @@sign_out_via = sign_out_via
-  end
-
  # The parent controller all Devise controllers inherits from.
  # Defaults to ApplicationController. This should be set early
  # in the initialization process and should be set to a string.
@@ -336,36 +277,10 @@ module Devise
  mattr_accessor :token_generator
  @@token_generator = nil

-  # Default way to set up Devise. Run rails generate devise_install to create
+  # Default way to setup Devise. Run rails generate devise_install to create
  # a fresh initializer with all configuration values.
  def self.setup
    yield self
-
-    warn_default_config_changed(:email_regexp, '/\A[^@\s]+@([^@\s]+\.)+[^@\W]+\z/', '/\A[^@\s]+@[^@\s]+\z/')
-    warn_default_config_changed(:reconfirmable, 'false', 'true')
-    warn_default_config_changed(:sign_out_via, ':get', ':delete')
-    warn_default_config_changed(:skip_session_storage, '[]', '[:http_auth]')
-    warn_default_config_changed(:strip_whitespace_keys, '[]', '[:email]')
-  end
-
-  def self.warn_default_config_changed(config, current_default, new_default)
-    unless app_set_configs.include?(config)
-      warn = <<-MESSAGE.strip_heredoc
-        [Devise] config.#{config} will have a new default on Devise 4.1
-        To keep the current behavior please set in your config/initializers/devise.rb the following:
-
-          Devise.setup do |config|
-            config.#{config} = #{current_default}
-          end
-
-        If you want to use the new default:
-
-          Devise.setup do |config|
-            config.#{config} = #{new_default}
-          end
-      MESSAGE
-      ActiveSupport::Deprecation.warn(warn)
-    end
  end

  class Getter
--- a/lib/devise/controllers/helpers.rb
+++ b/lib/devise/controllers/helpers.rb
@@ -30,8 +30,8 @@ module Devise
        #     current_bloggers       # Currently signed in user and admin
        #
        #   Use:
-        #     before_action :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
-        #     before_action ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
+        #     before_filter :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
+        #     before_filter ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
        #     current_blogger :user                             # Preferably returns a User if one is signed in
        #
        def devise_group(group_name, opts={})
@@ -84,7 +84,7 @@ module Devise
      end

      # Define authentication filters and accessor helpers based on mappings.
-      # These filters should be used inside the controllers as before_actions,
+      # These filters should be used inside the controllers as before_filters,
      # so you can control the scope of the user who should be signed in to
      # access that specific controller/action.
      # Example:
@@ -104,8 +104,8 @@ module Devise
      #     admin_session       # Session data available only to the admin scope
      #
      #   Use:
-      #     before_action :authenticate_user!  # Tell devise to use :user map
-      #     before_action :authenticate_admin! # Tell devise to use :admin map
+      #     before_filter :authenticate_user!  # Tell devise to use :user map
+      #     before_filter :authenticate_admin! # Tell devise to use :admin map
      #
      def self.define_helpers(mapping) #:nodoc:
        mapping = mapping.name
@@ -145,16 +145,20 @@ module Devise
      # the controllers defined inside devise. Useful if you want to apply a before
      # filter to all controllers, except the ones in devise:
      #
-      #   before_action :my_filter, unless: :devise_controller?
+      #   before_filter :my_filter, unless: :devise_controller?
      def devise_controller?
        is_a?(::DeviseController)
      end

-      # Set up a param sanitizer to filter parameters using strong_parameters. See
+      # Setup a param sanitizer to filter parameters using strong_parameters. See
      # lib/devise/parameter_sanitizer.rb for more info. Override this
      # method in your application controller to use your own parameter sanitizer.
      def devise_parameter_sanitizer
-        @devise_parameter_sanitizer ||= Devise::ParameterSanitizer.new(resource_class, resource_name, params)
+        @devise_parameter_sanitizer ||= if defined?(ActionController::StrongParameters)
+          Devise::ParameterSanitizer.new(resource_class, resource_name, params)
+        else
+          Devise::BaseSanitizer.new(resource_class, resource_name, params)
+        end
      end

      # Tell warden that params authentication is allowed for that specific page.
@@ -271,6 +275,12 @@ module Devise

      private

+      def expire_session_data_after_sign_in!
+        ActiveSupport::Deprecation.warn "expire_session_data_after_sign_in! is deprecated " \
+          "in favor of expire_data_after_sign_in!"
+        expire_data_after_sign_in!
+      end
+
      def expire_data_after_sign_out!
        Devise.mappings.each { |_,m| instance_variable_set("@current_#{m.name}", nil) }
        super
--- a/lib/devise/controllers/rememberable.rb
+++ b/lib/devise/controllers/rememberable.rb
@@ -12,8 +12,8 @@ module Devise
      def remember_me_is_active?(resource)
        return false unless resource.respond_to?(:remember_me)
        scope = Devise::Mapping.find_scope!(resource)
-        _, token, generated_at = cookies.signed[remember_key(resource, scope)]
-        resource.remember_me?(token, generated_at)
+        cookie = cookies.signed[remember_key(resource, scope)]
+        resource.class.serialized_in_cookie?(resource, *cookie)
      end

      # Remembers the given resource by setting up a cookie
--- a/lib/devise/encryptor.rb
+++ b/lib/devise/encryptor.rb
@@ -9,14 +9,14 @@ module Devise
      ::BCrypt::Password.create(password, cost: klass.stretches).to_s
    end

-    def self.compare(klass, hashed_password, password)
-      return false if hashed_password.blank?
-      bcrypt   = ::BCrypt::Password.new(hashed_password)
+    def self.compare(klass, encrypted_password, password)
+      return false if encrypted_password.blank?
+      bcrypt   = ::BCrypt::Password.new(encrypted_password)
      if klass.pepper.present?
        password = "#{password}#{klass.pepper}"
      end
      password = ::BCrypt::Engine.hash_secret(password, bcrypt.salt)
-      Devise.secure_compare(password, hashed_password)
+      Devise.secure_compare(password, encrypted_password)
    end
  end
 end
--- a/lib/devise/failure_app.rb
+++ b/lib/devise/failure_app.rb
@@ -6,6 +6,7 @@ module Devise
  # page based on current scope and mapping. If no scope is given, redirect
  # to the default_url.
  class FailureApp < ActionController::Metal
+    include ActionController::RackDelegation
    include ActionController::UrlFor
    include ActionController::Redirecting

@@ -21,7 +22,7 @@ module Devise
      @respond.call(env)
    end

-    # Try retrieving the URL options from the parent controller (usually
+    # Try retrieving the URL options from the parent controller (usually 
    # ApplicationController). Instance methods are not supported at the moment,
    # so only the class-level attribute is used.
    def self.default_url_options(*args)
@@ -52,27 +53,18 @@ module Devise
    def recall
      config = Rails.application.config

-      header_info = if config.try(:relative_url_root)
+      if config.try(:relative_url_root)
        base_path = Pathname.new(config.relative_url_root)
        full_path = Pathname.new(attempted_path)

-        { "SCRIPT_NAME" => config.relative_url_root,
-          "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
+        env["SCRIPT_NAME"] = config.relative_url_root
+        env["PATH_INFO"] = '/' + full_path.relative_path_from(base_path).to_s
      else
-        { "PATH_INFO" => attempted_path }
-      end
-
-      header_info.each do | var, value|
-        if request.respond_to?(:set_header)
-          request.set_header(var, value)
-        else
-          env[var]  = value
-        end
+        env["PATH_INFO"]  = attempted_path
      end

      flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
-      # self.response = recall_app(warden_options[:recall]).call(env)
-      self.response = recall_app(warden_options[:recall]).call(request.env)
+      self.response = recall_app(warden_options[:recall]).call(env)
    end

    def redirect
@@ -140,10 +132,11 @@ module Devise

      config = Rails.application.config

-      if config.respond_to?(:relative_url_root)
-        # Rails 4.2 goes into an infinite loop if opts[:script_name] is unset
-        rails_4_2 = (Rails::VERSION::MAJOR >= 4) && (Rails::VERSION::MINOR >= 2)
-        if config.relative_url_root.present? || rails_4_2
+      # Rails 4.2 goes into an infinite loop if opts[:script_name] is unset
+      if (Rails::VERSION::MAJOR >= 4) && (Rails::VERSION::MINOR >= 2)
+        opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))
+      else
+        if config.respond_to?(:relative_url_root) && config.relative_url_root.present?
          opts[:script_name] = config.relative_url_root
        end
      end
@@ -206,11 +199,11 @@ module Devise
    end

    def warden
-      request.respond_to?(:get_header) ? request.get_header("warden") : env["warden"]
+      env['warden']
    end

    def warden_options
-      request.respond_to?(:get_header) ? request.get_header("warden.options") : env["warden.options"]
+      env['warden.options']
    end

    def warden_message
--- a/lib/devise/mailers/helpers.rb
+++ b/lib/devise/mailers/helpers.rb
@@ -64,7 +64,7 @@ module Devise
        template_path
      end

-      # Set up a subject doing an I18n lookup. At first, it attempts to set a subject
+      # Setup a subject doing an I18n lookup. At first, it attempts to set a subject
      # based on the current mapping:
      #
      #   en:
--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -253,11 +253,7 @@ module Devise

        # Find or initialize a record with group of attributes based on a list of required attributes.
        def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
-          attributes = if attributes.respond_to? :permit!
-            attributes.slice(*required_attributes).permit!.to_h.with_indifferent_access
-          else
-            attributes.with_indifferent_access.slice(*required_attributes)
-          end
+          attributes = attributes.slice(*required_attributes).with_indifferent_access
          attributes.delete_if { |key, value| value.blank? }

          if attributes.size == required_attributes.size
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -24,7 +24,7 @@ module Devise
    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
-    #     db field to be set up (t.reconfirmable in migrations). Until confirmed, new email is
+    #     db field to be setup (t.reconfirmable in migrations). Until confirmed, new email is
    #     stored in unconfirmed email column, and copied to email column on successful
    #     confirmation.
    #   * +confirm_within+: the time before a sent confirmation token becomes invalid.
@@ -40,6 +40,7 @@ module Devise
    #
    module Confirmable
      extend ActiveSupport::Concern
+      include ActionView::Helpers::DateHelper

      included do
        before_create :generate_confirmation_token, if: :confirmation_required?
@@ -75,7 +76,7 @@ module Devise

          self.confirmed_at = Time.now.utc

-          saved = if pending_reconfirmation?
+          saved = if self.class.reconfirmable && unconfirmed_email.present?
            skip_reconfirmation!
            self.email = unconfirmed_email
            self.unconfirmed_email = nil
@@ -169,7 +170,6 @@ module Devise
        # in models to map to a nice sign up e-mail.
        def send_on_create_confirmation_instructions
          send_confirmation_instructions
-          skip_reconfirmation!
        end

        # Callback to overwrite if confirmation is required or not.
@@ -180,7 +180,7 @@ module Devise
        # Checks if the confirmation for the user is within the limit time.
        # We do this by calculating if the difference between today and the
        # confirmation sent date does not exceed the confirm in time configured.
-        # allow_unconfirmed_access_for is a model configuration, must always be an integer value.
+        # Confirm_within is a model configuration, must always be an integer value.
        #
        # Example:
        #
@@ -254,13 +254,13 @@ module Devise
        end

        def postpone_email_change?
-          postpone = self.class.reconfirmable && email_changed? && !@bypass_confirmation_postpone && self.email.present?
+          postpone = self.class.reconfirmable && email_changed? && email_was.present? && !@bypass_confirmation_postpone && self.email.present?
          @bypass_confirmation_postpone = false
          postpone
        end

        def reconfirmation_required?
-          self.class.reconfirmable && @reconfirmation_required && (self.email.present? || self.unconfirmed_email.present?)
+          self.class.reconfirmable && @reconfirmation_required && self.email.present?
        end

        def send_confirmation_notification?
@@ -315,7 +315,6 @@ module Devise

        # Find a record for confirmation by unconfirmed email field
        def find_by_unconfirmed_email_with_errors(attributes = {})
-          attributes = attributes.slice(*confirmation_keys).permit!.to_h if attributes.respond_to? :permit
          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
          unconfirmed_attributes = attributes.symbolize_keys
          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
--- a/lib/devise/models/database_authenticatable.rb
+++ b/lib/devise/models/database_authenticatable.rb
@@ -7,8 +7,8 @@ module Devise
  end

  module Models
-    # Authenticatable Module, responsible for hashing the password and
-    # validating the authenticity of a user while signing in.
+    # Authenticatable Module, responsible for encrypting password and validating
+    # authenticity of a user while signing in.
    #
    # == Options
    #
@@ -37,9 +37,7 @@ module Devise
        [:encrypted_password] + klass.authentication_keys
      end

-      # Generates a hashed password based on the given value.
-      # For legacy reasons, we use `encrypted_password` to store
-      # the hashed password.
+      # Generates password encryption based on the given value.
      def password=(new_password)
        @password = new_password
        self.encrypted_password = password_digest(@password) if @password.present?
@@ -143,11 +141,11 @@ module Devise

    protected

-      # Hashes the password using bcrypt. Custom hash functions should override
+      # Digests the password using bcrypt. Custom encryption should override
      # this method to apply their own algorithm.
      #
      # See https://github.com/plataformatec/devise-encryptable for examples
-      # of other hashing engines.
+      # of other encryption engines.
      def password_digest(password)
        Devise::Encryptor.digest(self.class, password)
      end
--- a/lib/devise/models/lockable.rb
+++ b/lib/devise/models/lockable.rb
@@ -7,7 +7,7 @@ module Devise
    # blocked: email and time. The former will send an email to the user when
    # the lock happens, containing a link to unlock its account. The second
    # will unlock the user automatically after some configured time (ie 2.hours).
-    # It's also possible to set up lockable to use both email and time strategies.
+    # It's also possible to setup lockable to use both email and time strategies.
    #
    # == Options
    #
--- a/lib/devise/models/rememberable.rb
+++ b/lib/devise/models/rememberable.rb
@@ -39,13 +39,15 @@ module Devise
    module Rememberable
      extend ActiveSupport::Concern

-      attr_accessor :remember_me
+      attr_accessor :remember_me, :extend_remember_period

      def self.required_fields(klass)
        [:remember_created_at]
      end

-      def remember_me!
+      # TODO: We were used to receive a extend period argument but we no longer do.
+      # Remove this for Devise 4.0.
+      def remember_me!(*)
        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
        self.remember_created_at ||= Time.now.utc
        save(validate: false) if self.changed?
@@ -60,12 +62,13 @@ module Devise
        save(validate: false)
      end

-      def remember_expires_at
-        self.class.remember_for.from_now
+      # Remember token should be expired if expiration time not overpass now.
+      def remember_expired?
+        remember_created_at.nil?
      end

-      def extend_remember_period
-        self.class.extend_remember_period
+      def remember_expires_at
+        self.class.remember_for.from_now
      end

      def rememberable_value
@@ -98,47 +101,21 @@ module Devise
      def after_remembered
      end

-      def remember_me?(token, generated_at)
-        # TODO: Normalize the JSON type coercion along with the Timeoutable hook
-        # in a single place https://github.com/plataformatec/devise/blob/ffe9d6d406e79108cf32a2c6a1d0b3828849c40b/lib/devise/hooks/timeoutable.rb#L14-L18
-        if generated_at.is_a?(String)
-          generated_at = time_from_json(generated_at)
-        end
-
-        # The token is only valid if:
-        # 1. we have a date
-        # 2. the current time does not pass the expiry period
-        # 3. the record has a remember_created_at date
-        # 4. the token date is bigger than the remember_created_at
-        # 5. the token matches
-        generated_at.is_a?(Time) &&
-         (self.class.remember_for.ago < generated_at) &&
-         (generated_at > (remember_created_at || Time.now).utc) &&
-         Devise.secure_compare(rememberable_value, token)
-      end
-
-      private
-
-      def time_from_json(value)
-        if value =~ /\A\d+\.\d+\Z/
-          Time.at(value.to_f)
-        else
-          Time.parse(value) rescue nil
-        end
-      end

      module ClassMethods
        # Create the cookie key using the record id and remember_token
        def serialize_into_cookie(record)
-          [record.to_key, record.rememberable_value, Time.now.utc.to_f.to_s]
+          [record.to_key, record.rememberable_value, Time.now.utc]
        end

        # Recreate the user based on the stored cookie
        def serialize_from_cookie(*args)
-          id, token, generated_at = *args
+          serialize_from_cookie_with_or_without_record(nil, args)
+        end

-          record = to_adapter.get(id)
-          record if record && record.remember_me?(token, generated_at)
+        # Check if the given record is the one serialized in cookie
+        def serialized_in_cookie?(record, *args)
+          !!serialize_from_cookie_with_or_without_record(record, args)
        end

        # Generate a token checking if one does not already exist in the database.
@@ -149,6 +126,29 @@ module Devise
          end
        end

+        private
+
+        def serialize_from_cookie_with_or_without_record(record, args)
+          id, token, generated_at = args
+
+          # The token is only valid if:
+          # 1. we have a date
+          # 2. the current time does not pass the expiry period
+          # 3. there is a record with the given id
+          # 4. the record has a remember_created_at date
+          # 5. the token date is bigger than the remember_created_at
+          # 6. the token matches
+          if generated_at &&
+             (self.remember_for.ago < generated_at) &&
+             (record ||= to_adapter.get(id)) && (id == record.to_key) &&
+             (generated_at > (record.remember_created_at || Time.now).utc) &&
+             Devise.secure_compare(record.rememberable_value, token)
+            record
+          end
+        end
+
+
+        # TODO: extend_remember_period is no longer used
        Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options, :expire_all_remember_me_on_sign_out)
      end
    end
--- a/lib/devise/omniauth/url_helpers.rb
+++ b/lib/devise/omniauth/url_helpers.rb
@@ -2,74 +2,16 @@ module Devise
  module OmniAuth
    module UrlHelpers
      def self.define_helpers(mapping)
-        return unless mapping.omniauthable?
-
-        mapping = mapping.name
-
-        class_eval do
-          define_method("#{mapping}_omniauth_authorize_path") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_authorize_path(#{provider.inspect}) is deprecated and it will be removed from Devise 4.1.
-
-            Please use #{mapping}_#{provider}_omniauth_authorize_path instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_authorize_path", *args)
-          end
-
-          define_method("#{mapping}_omniauth_authorize_url") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_authorize_url(#{provider.inspect}) is deprecated and it will be removed from Devise 4.1.
-
-            Please use #{mapping}_#{provider}_omniauth_authorize_url instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_authorize_url", *args)
-          end
-
-          define_method("#{mapping}_omniauth_callback_path") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_callback_path(#{provider.inspect}) is deprecated and it will be removed from Devise 4.1.
-
-            Please use #{mapping}_#{provider}_omniauth_callback_path instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_callback_path", *args)
-          end
-
-          define_method("#{mapping}_omniauth_callback_url") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_callback_url(#{provider.inspect}) is deprecated and it will be removed from Devise 4.1.
-
-            Please use #{mapping}_#{provider}_omniauth_callback_url instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_callback_url", *args)
-          end
-        end
-
-        ActiveSupport.on_load(:action_controller) do
-          if respond_to?(:helper_method)
-            helper_method "#{mapping}_omniauth_authorize_path", "#{mapping}_omniauth_authorize_url"
-            helper_method "#{mapping}_omniauth_callback_path", "#{mapping}_omniauth_callback_url"
-          end
-        end
      end

-      def omniauth_authorize_path(resource_or_scope, provider, *args)
+      def omniauth_authorize_path(resource_or_scope, *args)
        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_path", *args)
+        _devise_route_context.send("#{scope}_omniauth_authorize_path", *args)
      end

-      def omniauth_authorize_url(resource_or_scope, provider, *args)
+      def omniauth_callback_path(resource_or_scope, *args)
        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_url", *args)
-      end
-
-      def omniauth_callback_path(resource_or_scope, provider, *args)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_path", *args)
-      end
-
-      def omniauth_callback_url(resource_or_scope, provider, *args)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_url", *args)
+        _devise_route_context.send("#{scope}_omniauth_callback_path", *args)
      end
    end
  end
--- a/lib/devise/parameter_sanitizer.rb
+++ b/lib/devise/parameter_sanitizer.rb
@@ -1,214 +1,99 @@
 module Devise
-  # The +ParameterSanitizer+ deals with permitting specific parameters values
-  # for each +Devise+ scope in the application.
-  #
-  # The sanitizer knows about Devise default parameters (like +password+ and
-  # +password_confirmation+ for the `RegistrationsController`), and you can
-  # extend or change the permitted parameters list on your controllers.
-  #
-  # === Permitting new parameters
-  #
-  # You can add new parameters to the permitted list using the +permit+ method
-  # in a +before_action+ method, for instance.
-  #
-  #    class ApplicationController < ActionController::Base
-  #      before_action :configure_permitted_parameters, if: :devise_controller?
-  #
-  #      protected
-  #
-  #      def configure_permitted_parameters
-  #        # Permit the `subscribe_newsletter` parameter along with the other
-  #        # sign up parameters.
-  #        devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
-  #      end
-  #    end
-  #
-  # Using a block yields an +ActionController::Parameters+ object so you can
-  # permit nested parameters and have more control over how the parameters are
-  # permitted in your controller.
-  #
-  #    def configure_permitted_parameters
-  #      devise_parameter_sanitizer.permit(:sign_up) do |user|
-  #        user.permit(newsletter_preferences: [])
-  #      end
-  #    end
-  class ParameterSanitizer
-    DEFAULT_PERMITTED_ATTRIBUTES = {
-      sign_in: [:password, :remember_me],
-      sign_up: [:password, :password_confirmation],
-      account_update: [:password, :password_confirmation, :current_password]
-    }
+  class BaseSanitizer
+    attr_reader :params, :resource_name, :resource_class

    def initialize(resource_class, resource_name, params)
-      @auth_keys      = extract_auth_keys(resource_class)
-      @params         = params
+      @resource_class = resource_class
      @resource_name  = resource_name
-      @permitted      = {}
-
-      DEFAULT_PERMITTED_ATTRIBUTES.each_pair do |action, keys|
-        permit(action, keys: keys)
-      end
+      @params         = params
+      @blocks         = Hash.new
    end

-    # Sanitize the parameters for a specific +action+.
-    #
-    # === Arguments
-    #
-    # * +action+ - A +Symbol+ with the action that the controller is
-    #   performing, like +sign_up+, +sign_in+, etc.
-    #
-    # === Examples
-    #
-    #    # Inside the `RegistrationsController#create` action.
-    #    resource = build_resource(devise_parameter_sanitizer.sanitize(:sign_up))
-    #    resource.save
-    #
-    # Returns an +ActiveSupport::HashWithIndifferentAccess+ with the permitted
-    # attributes.
-    def sanitize(action)
-      permissions = @permitted[action]
-
-      # DEPRECATED: Remove this branch on Devise 4.1.
-      if respond_to?(action, true)
-        deprecate_instance_method_sanitization(action)
-        return cast_to_hash send(action)
-      end
-
-      if permissions.respond_to?(:call)
-        cast_to_hash permissions.call(default_params)
-      elsif permissions.present?
-        cast_to_hash permit_keys(default_params, permissions)
-      else
-        unknown_action!(action)
-      end
-    end
-
-    # Add or remove new parameters to the permitted list of an +action+.
-    #
-    # === Arguments
-    #
-    # * +action+ - A +Symbol+ with the action that the controller is
-    #   performing, like +sign_up+, +sign_in+, etc.
-    # * +keys:+     - An +Array+ of keys that also should be permitted.
-    # * +except:+   - An +Array+ of keys that shouldn't be permitted.
-    # * +block+     - A block that should be used to permit the action
-    #   parameters instead of the +Array+ based approach. The block will be
-    #   called with an +ActionController::Parameters+ instance.
-    #
-    # === Examples
-    #
-    #   # Adding new parameters to be permitted in the `sign_up` action.
-    #   devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
-    #
-    #   # Removing the `password` parameter from the `account_update` action.
-    #   devise_parameter_sanitizer.permit(:account_update, except: [:password])
-    #
-    #   # Using the block form to completely override how we permit the
-    #   # parameters for the `sign_up` action.
-    #   devise_parameter_sanitizer.permit(:sign_up) do |user|
-    #     user.permit(:email, :password, :password_confirmation)
-    #   end
-    #
-    #
-    # Returns nothing.
-    def permit(action, keys: nil, except: nil, &block)
+    def for(kind, &block)
      if block_given?
-        @permitted[action] = block
-      end
-
-      if keys.present?
-        @permitted[action] ||= @auth_keys.dup
-        @permitted[action].concat(keys)
-      end
-
-      if except.present?
-        @permitted[action] ||= @auth_keys.dup
-        @permitted[action] = @permitted[action] - except
+        @blocks[kind] = block
+      else
+        default_for(kind)
      end
    end

-    # DEPRECATED: Remove this method on Devise 4.1.
-    def for(action, &block) # :nodoc:
-      if block_given?
-        deprecate_for_with_block(action)
-        permit(action, &block)
+    def sanitize(kind)
+      if block = @blocks[kind]
+        block.call(default_params)
      else
-        deprecate_for_without_block(action)
-        @permitted[action] or unknown_action!(action)
+        default_sanitize(kind)
      end
    end

    private

-    # Cast a sanitized +ActionController::Parameters+ to a +HashWithIndifferentAccess+
-    # that can be used elsewhere.
-    #
-    # Returns an +ActiveSupport::HashWithIndifferentAccess+.
-    def cast_to_hash(params)
-      # TODO: Remove the `with_indifferent_access` method call when we only support Rails 5+.
-      params && params.to_h.with_indifferent_access
+    def default_for(kind)
+      raise ArgumentError, "a block is expected in Devise base sanitizer"
+    end
+
+    def default_sanitize(kind)
+      default_params
    end

    def default_params
-      @params.fetch(@resource_name, {})
+      params.fetch(resource_name, {})
+    end
+  end
+
+  class ParameterSanitizer < BaseSanitizer
+    def initialize(*)
+      super
+      @permitted = Hash.new { |h,k| h[k] = attributes_for(k) }
    end

-    def permit_keys(parameters, keys)
-      parameters.permit(*keys)
+    def sign_in
+      permit self.for(:sign_in)
    end

-    def extract_auth_keys(klass)
-      auth_keys = klass.authentication_keys
-
-      auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
+    def sign_up
+      permit self.for(:sign_up)
    end

-    def unknown_action!(action)
-      raise NotImplementedError, <<-MESSAGE.strip_heredoc
-        "Devise doesn't know how to sanitize parameters for '#{action}'".
-        If you want to define a new set of parameters to be sanitized use the
-        `permit` method first:
-
-          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
-      MESSAGE
+    def account_update
+      permit self.for(:account_update)
    end

-    def deprecate_for_with_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method:
+    private

-          devise_parameter_sanitizer.permit(:#{action}) do |user|
-            # Your block here.
-          end
-      MESSAGE
+    # TODO: We do need to flatten so it works with strong_parameters
+    # gem. We should drop it once we move to Rails 4 only support.
+    def permit(keys)
+      default_params.permit(*Array(keys))
    end

-    def deprecate_for_without_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method to add or remove any key:
-
-          To add any new key, use the `keys` keyword argument:
-          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
-
-          To remove any existing key, use the `except` keyword argument:
-          devise_parameter_sanitizer.permit(:#{action}, except: [:email])
-      MESSAGE
+    # Change for(kind) to return the values in the @permitted
+    # hash, allowing the developer to customize at runtime.
+    def default_for(kind)
+      @permitted[kind] || raise("No sanitizer provided for #{kind}")
    end

-    def deprecate_instance_method_sanitization(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Parameter sanitization through a "#{self.class.name}##{action}" method is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method on your sanitizer `initialize` method.
+    def default_sanitize(kind)
+      if respond_to?(kind, true)
+        send(kind)
+      else
+        raise NotImplementedError, "Devise doesn't know how to sanitize parameters for #{kind}"
+      end
+    end

-          class #{self.class.name} < Devise::ParameterSanitizer
-            def initialize(*)
-              super
-              permit(:#{action}, keys: [:param1, :param2, :param3])
-            end
-          end
-      MESSAGE
+    def attributes_for(kind)
+      case kind
+      when :sign_in
+        auth_keys + [:password, :remember_me]
+      when :sign_up
+        auth_keys + [:password, :password_confirmation]
+      when :account_update
+        auth_keys + [:password, :password_confirmation, :current_password]
+      end
+    end
+
+    def auth_keys
+      @auth_keys ||= @resource_class.authentication_keys.respond_to?(:keys) ?
+                       @resource_class.authentication_keys.keys : @resource_class.authentication_keys
    end
  end
 end
--- a/lib/devise/rails.rb
+++ b/lib/devise/rails.rb
@@ -39,9 +39,18 @@ module Devise
      Devise.token_generator ||=
        if secret_key = Devise.secret_key
          Devise::TokenGenerator.new(
-            ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
+            Devise::CachingKeyGenerator.new(Devise::KeyGenerator.new(secret_key))
          )
        end
    end
+
+    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
+      # Deprecate: Remove once we move to Rails 4 only.
+      ActionDispatch::Routing::RoutesProxy.class_eval do
+        def respond_to?(method, include_private = false)
+          super || routes.url_helpers.respond_to?(method)
+        end
+      end
+    end
  end
 end
--- a/lib/devise/rails/routes.rb
+++ b/lib/devise/rails/routes.rb
@@ -1,10 +1,13 @@
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"

-module Devise
-  module RouteSet
-    def finalize!
-      result = super
+module ActionDispatch::Routing
+  class RouteSet #:nodoc:
+    # Ensure Devise modules are included only after loading routes, because we
+    # need devise_for mappings already declared to create filters and helpers.
+    def finalize_with_devise!
+      result = finalize_without_devise!
+
      @devise_finalized ||= begin
        if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
          warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
@@ -18,16 +21,10 @@ module Devise
        Devise.regenerate_helpers!
        true
      end
+
      result
    end
-  end
-end
-
-module ActionDispatch::Routing
-  class RouteSet #:nodoc:
-    # Ensure Devise modules are included only after loading routes, because we
-    # need devise_for mappings already declared to create filters and helpers.
-    prepend Devise::RouteSet
+    alias_method_chain :finalize!, :devise
  end

  class Mapper
@@ -87,17 +84,17 @@ module ActionDispatch::Routing
    #
    # You can configure your routes with some options:
    #
-    #  * class_name: set up a different class to be looked up by devise, if it cannot be
+    #  * class_name: setup a different class to be looked up by devise, if it cannot be
    #    properly found by the route name.
    #
    #      devise_for :users, class_name: 'Account'
    #
-    #  * path: allows you to set up path name that will be used, as rails routes does.
-    #    The following route configuration would set up your route as /accounts instead of /users:
+    #  * path: allows you to setup path name that will be used, as rails routes does.
+    #    The following route configuration would setup your route as /accounts instead of /users:
    #
    #      devise_for :users, path: 'accounts'
    #
-    #  * singular: set up the singular name for the given resource. This is used as the helper methods
+    #  * singular: setup the singular name for the given resource. This is used as the helper methods
    #    names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
    #    and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
    #
@@ -108,7 +105,7 @@ module ActionDispatch::Routing
    #      end
    #
    #      class ManagerController < ApplicationController
-    #        before_action authenticate_manager!
+    #        before_filter authenticate_manager!
    #
    #        def show
    #          @manager = current_manager
@@ -431,29 +428,27 @@ options to another `devise_for` call outside the scope. Here is an example:
    end
 ERROR
        end
-        current_scope = @scope.dup
-        if @scope.respond_to? :new
-          @scope = @scope.new path: nil
-        else
-          @scope[:path] = nil
-        end
+
+        path, @scope[:path] = @scope[:path], nil
        path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")

        set_omniauth_path_prefix!(path_prefix)

-        mapping.to.omniauth_providers.each do |provider|
-          match "#{path_prefix}/#{provider}",
-            to: "#{controllers[:omniauth_callbacks]}#passthru",
-            as: "#{provider}_omniauth_authorize",
-            via: [:get, :post]
+        providers = Regexp.union(mapping.to.omniauth_providers.map(&:to_s))

-          match "#{path_prefix}/#{provider}/callback",
-            to: "#{controllers[:omniauth_callbacks]}##{provider}",
-            as: "#{provider}_omniauth_callback",
-            via: [:get, :post]
-        end
+        match "#{path_prefix}/:provider",
+          constraints: { provider: providers },
+          to: "#{controllers[:omniauth_callbacks]}#passthru",
+          as: :omniauth_authorize,
+          via: [:get, :post]
+
+        match "#{path_prefix}/:action/callback",
+          constraints: { action: providers },
+          to: "#{controllers[:omniauth_callbacks]}#:action",
+          as: :omniauth_callback,
+          via: [:get, :post]
      ensure
-        @scope = current_scope
+        @scope[:path] = path
      end

      def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
@@ -462,11 +457,7 @@ ERROR
        exclusive = { as: new_as, path: new_path, module: nil }
        exclusive.merge!(options.slice(:constraints, :defaults, :options))

-        if @scope.respond_to? :new
-          @scope = @scope.new exclusive
-        else
-          exclusive.each_pair { |key, value| @scope[key] = value }
-        end
+        exclusive.each_pair { |key, value| @scope[key] = value }
        yield
      ensure
        @scope = current_scope
--- a/lib/devise/rails/warden_compat.rb
+++ b/lib/devise/rails/warden_compat.rb
@@ -3,8 +3,17 @@ module Warden::Mixins::Common
    @request ||= ActionDispatch::Request.new(env)
  end

+  # Deprecate: Remove this check once we move to Rails 4 only.
+  NULL_STORE =
+    defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
+      ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil
+
  def reset_session!
-    request.reset_session
+    # Calling reset_session on NULL_STORE causes it fail.
+    # This is a bug that needs to be fixed in Rails.
+    unless NULL_STORE && request.session.is_a?(NULL_STORE)
+      request.reset_session
+    end
  end

  def cookies
--- a/lib/devise/strategies/database_authenticatable.rb
+++ b/lib/devise/strategies/database_authenticatable.rb
@@ -6,15 +6,15 @@ module Devise
    class DatabaseAuthenticatable < Authenticatable
      def authenticate!
        resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
-        hashed = false
+        encrypted = false

-        if validate(resource){ hashed = true; resource.valid_password?(password) }
+        if validate(resource){ encrypted = true; resource.valid_password?(password) }
          remember_me(resource)
          resource.after_database_authentication
          success!(resource)
        end

-        mapping.to.new.password = password if !hashed && Devise.paranoid
+        mapping.to.new.password = password if !encrypted && Devise.paranoid
        fail(:not_found_in_database) unless resource
      end
    end
--- a/lib/devise/strategies/rememberable.rb
+++ b/lib/devise/strategies/rememberable.rb
@@ -25,7 +25,8 @@ module Devise
        end

        if validate(resource)
-          remember_me(resource) if extend_remember_me?(resource)
+          remember_me(resource)
+          extend_remember_me_period(resource)
          resource.after_remembered
          success!(resource)
        end
@@ -42,8 +43,10 @@ module Devise

    private

-      def extend_remember_me?(resource)
-        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
+      def extend_remember_me_period(resource)
+        if resource.respond_to?(:extend_remember_period=)
+          resource.extend_remember_period = mapping.to.extend_remember_period
+        end
      end

      def remember_me?
--- a/lib/devise/test_helpers.rb
+++ b/lib/devise/test_helpers.rb
@@ -16,13 +16,10 @@ module Devise
    # Override process to consider warden.
    def process(*)
      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } # || @response  # _catch_warden will setup the @response object
-
-      # process needs to return the ActionDispath::TestResponse object
-      @response
+      _catch_warden { super } || @response
    end

-    # We need to set up the environment variables and the response in the controller.
+    # We need to setup the environment variables and the response in the controller.
    def setup_controller_for_warden #:nodoc:
      @request.env['action_controller.instance'] = @controller
    end
@@ -112,9 +109,8 @@ module Devise

        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
        @controller.response.headers.merge!(headers)
-        r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
-        r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
-        @controller.send :render, r_opts
+        @controller.send :render, status: status, text: response.body,
+          content_type: headers["Content-Type"], location: headers["Location"]
        nil # causes process return @response
      end

@@ -126,8 +122,7 @@ module Devise
        # ensure the controller response is set to our response.
        @controller.response ||= @response
        @response.status = ret.first
-        @response.headers.clear
-        ret.second.each { |k,v| @response[k] = v }
+        @response.headers = ret.second
        @response.body = ret.third
      end

--- a/lib/devise/token_generator.rb
+++ b/lib/devise/token_generator.rb
@@ -1,8 +1,11 @@
+# Deprecate: Copied verbatim from Rails source, remove once we move to Rails 4 only.
+require 'thread_safe'
 require 'openssl'
+require 'securerandom'

 module Devise
  class TokenGenerator
-    def initialize(key_generator, digest = "SHA256")
+    def initialize(key_generator, digest="SHA256")
      @key_generator = key_generator
      @digest = digest
    end
@@ -27,4 +30,41 @@ module Devise
      @key_generator.generate_key("Devise #{column}")
    end
  end
+
+  # KeyGenerator is a simple wrapper around OpenSSL's implementation of PBKDF2
+  # It can be used to derive a number of keys for various purposes from a given secret.
+  # This lets Rails applications have a single secure secret, but avoid reusing that
+  # key in multiple incompatible contexts.
+  class KeyGenerator
+    def initialize(secret, options = {})
+      @secret = secret
+      # The default iterations are higher than required for our key derivation uses
+      # on the off chance someone uses this for password storage
+      @iterations = options[:iterations] || 2**16
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
+    end
+  end
+
+  # CachingKeyGenerator is a wrapper around KeyGenerator which allows users to avoid
+  # re-executing the key generation process when it's called using the same salt and
+  # key_size
+  class CachingKeyGenerator
+    def initialize(key_generator)
+      @key_generator = key_generator
+      @cache_keys = ThreadSafe::Cache.new
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      @cache_keys["#{salt}#{key_size}"] ||= @key_generator.generate_key(salt, key_size)
+    end
+  end
 end
--- a/lib/devise/version.rb
+++ b/lib/devise/version.rb
@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "4.0.1".freeze
+  VERSION = "3.5.5".freeze
 end
--- a/lib/generators/active_record/devise_generator.rb
+++ b/lib/generators/active_record/devise_generator.rb
@@ -11,9 +11,9 @@ module ActiveRecord

      def copy_devise_migration
        if (behavior == :invoke && model_exists?) || (behavior == :revoke && migration_exists?(table_name))
-          migration_template "migration_existing.rb", "db/migrate/add_devise_to_#{table_name}.rb", migration_version: migration_version
+          migration_template "migration_existing.rb", "db/migrate/add_devise_to_#{table_name}.rb"
        else
-          migration_template "migration.rb", "db/migrate/devise_create_#{table_name}.rb", migration_version: migration_version
+          migration_template "migration.rb", "db/migrate/devise_create_#{table_name}.rb"
        end
      end

@@ -75,23 +75,17 @@ RUBY
      end

      def inet?
-        postgresql?
+        rails4? && postgresql?
      end

-      def rails5?
-        Rails.version.start_with? '5'
+      def rails4?
+        Rails.version.start_with? '4'
      end

      def postgresql?
        config = ActiveRecord::Base.configurations[Rails.env]
        config && config['adapter'] == 'postgresql'
      end
-
-     def migration_version
-       if rails5?
-         "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
-       end
-     end
    end
  end
 end
--- a/lib/generators/active_record/templates/migration.rb
+++ b/lib/generators/active_record/templates/migration.rb
@@ -1,6 +1,6 @@
-class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
+class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
  def change
-    create_table :<%= table_name %> do |t|
+    create_table(:<%= table_name %>) do |t|
 <%= migration_data -%>

 <% attributes.each  do |attribute| -%>
--- a/lib/generators/active_record/templates/migration_existing.rb
+++ b/lib/generators/active_record/templates/migration_existing.rb
@@ -1,6 +1,6 @@
-class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
+class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
  def self.up
-    change_table :<%= table_name %> do |t|
+    change_table(:<%= table_name %>) do |t|
 <%= migration_data -%>

 <% attributes.each  do |attribute| -%>
--- a/lib/generators/devise/install_generator.rb
+++ b/lib/generators/devise/install_generator.rb
@@ -3,8 +3,6 @@ require 'securerandom'

 module Devise
  module Generators
-    MissingORMError = Class.new(Thor::Error)
-
    class InstallGenerator < Rails::Generators::Base
      source_root File.expand_path("../../templates", __FILE__)

@@ -12,19 +10,6 @@ module Devise
      class_option :orm

      def copy_initializer
-        unless options[:orm]
-          raise MissingORMError, <<-ERROR.strip_heredoc
-          An ORM must be set to install Devise in your application.
-
-          Be sure to have an ORM like Active Record or Mongoid loaded in your
-          app or configure your own at `config/application.rb`.
-
-            config.generators do |g|
-              g.orm :your_orm_gem
-            end
-          ERROR
-        end
-
        template "devise.rb", "config/initializers/devise.rb"
      end

--- a/lib/generators/devise/orm_helpers.rb
+++ b/lib/generators/devise/orm_helpers.rb
@@ -8,14 +8,31 @@ module Devise
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

+CONTENT
+        buffer += <<-CONTENT if needs_attr_accessible?
+  # Setup accessible (or protected) attributes for your model
+  attr_accessible :email, :password, :password_confirmation, :remember_me
+
 CONTENT
        buffer
      end

+      def needs_attr_accessible?
+        rails_3? && !strong_parameters_enabled?
+      end
+
+      def rails_3?
+        Rails::VERSION::MAJOR == 3
+      end
+
+      def strong_parameters_enabled?
+        defined?(ActionController::StrongParameters)
+      end
+
      private

      def model_exists?
-        File.exist?(File.join(destination_root, model_path))
+        File.exists?(File.join(destination_root, model_path))
      end

      def migration_exists?(table_name)
--- a/lib/generators/templates/controllers/registrations_controller.rb
+++ b/lib/generators/templates/controllers/registrations_controller.rb
@@ -1,6 +1,6 @@
 class <%= @scope_prefix %>RegistrationsController < Devise::RegistrationsController
-# before_action :configure_sign_up_params, only: [:create]
-# before_action :configure_account_update_params, only: [:update]
+# before_filter :configure_sign_up_params, only: [:create]
+# before_filter :configure_account_update_params, only: [:update]

  # GET /resource/sign_up
  # def new
@@ -40,12 +40,12 @@ class <%= @scope_prefix %>RegistrationsController < Devise::RegistrationsControl

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_sign_up_params
-  #   devise_parameter_sanitizer.permit(:sign_up, keys: [:attribute])
+  #   devise_parameter_sanitizer.for(:sign_up) << :attribute
  # end

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_account_update_params
-  #   devise_parameter_sanitizer.permit(:account_update, keys: [:attribute])
+  #   devise_parameter_sanitizer.for(:account_update) << :attribute
  # end

  # The path used after sign up.
--- a/lib/generators/templates/controllers/sessions_controller.rb
+++ b/lib/generators/templates/controllers/sessions_controller.rb
@@ -1,5 +1,5 @@
 class <%= @scope_prefix %>SessionsController < Devise::SessionsController
-# before_action :configure_sign_in_params, only: [:create]
+# before_filter :configure_sign_in_params, only: [:create]

  # GET /resource/sign_in
  # def new
@@ -20,6 +20,6 @@ class <%= @scope_prefix %>SessionsController < Devise::SessionsController

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_sign_in_params
-  #   devise_parameter_sanitizer.permit(:sign_in, keys: [:attribute])
+  #   devise_parameter_sanitizer.for(:sign_in) << :attribute
  # end
 end
--- a/lib/generators/templates/devise.rb
+++ b/lib/generators/templates/devise.rb
@@ -4,9 +4,13 @@ Devise.setup do |config|
  # The secret key used by Devise. Devise uses this key to generate
  # random tokens. Changing this key will render invalid all existing
  # confirmation, reset password and unlock tokens in the database.
-  # Devise will use the `secret_key_base` as its `secret_key`
+  # Devise will use the `secret_key_base` on Rails 4+ applications as its `secret_key`
  # by default. You can change it below and use your own secret key.
+<% if  rails_4? -%>
  # config.secret_key = '<%= SecureRandom.hex(64) %>'
+<% else -%>
+  config.secret_key = '<%= SecureRandom.hex(64) %>'
+<% end -%>

  # ==> Mailer Configuration
  # Configure the e-mail address which will be shown in Devise::Mailer,
@@ -17,9 +21,6 @@ Devise.setup do |config|
  # Configure the class responsible to send e-mails.
  # config.mailer = 'Devise::Mailer'

-  # Configure the parent class responsible to send e-mails.
-  # config.parent_mailer = 'ActionMailer::Base'
-
  # ==> ORM configuration
  # Load and configure the ORM. Supports :active_record (default) and
  # :mongoid (bson_ext recommended) by default. Other ORMs may be
@@ -91,17 +92,17 @@ Devise.setup do |config|
  # config.clean_up_csrf_token_on_authentication = true

  # ==> Configuration for :database_authenticatable
-  # For bcrypt, this is the cost for hashing the password and defaults to 11. If
-  # using other algorithms, it sets how many times you want the password to be hashed.
+  # For bcrypt, this is the cost for hashing the password and defaults to 10. If
+  # using other encryptors, it sets how many times you want the password re-encrypted.
  #
  # Limiting the stretches to just one in testing will increase the performance of
  # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use
  # a value less than 10 in other environments. Note that, for bcrypt (the default
-  # algorithm), the cost increases exponentially with the number of stretches (e.g.
+  # encryptor), the cost increases exponentially with the number of stretches (e.g.
  # a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation).
-  config.stretches = Rails.env.test? ? 1 : 11
+  config.stretches = Rails.env.test? ? 1 : 10

-  # Set up a pepper to generate the hashed password.
+  # Setup a pepper to generate the encrypted password.
  # config.pepper = '<%= SecureRandom.hex(64) %>'

  # Send a notification email when the user's password is changed
@@ -148,12 +149,12 @@ Devise.setup do |config|

  # ==> Configuration for :validatable
  # Range for password length.
-  config.password_length = 6..128
+  config.password_length = 8..72

  # Email regex used to validate email formats. It simply asserts that
  # one (and only one) @ exists in the given string. This is mainly
  # to give user feedback and not to assert the e-mail validity.
-  config.email_regexp = /\A[^@]+@[^@]+\z/
+  # config.email_regexp = /\A[^@]+@[^@]+\z/

  # ==> Configuration for :timeoutable
  # The time you want to timeout the user session without activity. After this
@@ -201,11 +202,11 @@ Devise.setup do |config|
  # config.sign_in_after_reset_password = true

  # ==> Configuration for :encryptable
-  # Allow you to use another hashing or encryption algorithm besides bcrypt (default).
-  # You can use :sha1, :sha512 or algorithms from others authentication tools as
-  # :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20
-  # for default behavior) and :restful_authentication_sha1 (then you should set
-  # stretches to 10, and copy REST_AUTH_SITE_KEY to pepper).
+  # Allow you to use another encryption algorithm besides bcrypt (default). You can use
+  # :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1,
+  # :authlogic_sha512 (then you should set stretches above to 20 for default behavior)
+  # and :restful_authentication_sha1 (then you should set stretches to 10, and copy
+  # REST_AUTH_SITE_KEY to pepper).
  #
  # Require the `devise-encryptable` gem when using anything other than bcrypt
  # config.encryptor = :sha512
--- a/script/cached-bundle
+++ b/script/cached-bundle
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Usage: cached-bundle install --deployment
+#
+# After running `bundle`, caches the `vendor/bundle` directory to S3.
+# On the next run, restores the cached directory before running `bundle`.
+# When `Gemfile.lock` changes, the cache gets rebuilt.
+#
+# Requirements:
+# - Gemfile.lock
+# - TRAVIS_REPO_SLUG
+# - TRAVIS_RUBY_VERSION
+# - AMAZON_S3_BUCKET
+# - script/s3-put
+# - bundle
+# - curl
+#
+# Author: Mislav Marohnić
+
+set -e
+
+compute_md5() {
+  local output="$(openssl md5)"
+  echo "${output##* }"
+}
+
+download() {
+  curl --tcp-nodelay -qsfL "$1" -o "$2"
+}
+
+
+gemfile="${BUNDLE_GEMFILE:-Gemfile}"
+bundle_fullpath="$(dirname $gemfile)/vendor/bundle"
+bundle_path=${bundle_fullpath#$PWD/}
+gemfile_hash="$(compute_md5 <"${gemfile}.lock")"
+cache_name="${TRAVIS_RUBY_VERSION}-${gemfile_hash}.tgz"
+fetch_url="http://${AMAZON_S3_BUCKET}.s3.amazonaws.com/${TRAVIS_REPO_SLUG}/${cache_name}"
+
+if download "$fetch_url" "$cache_name"; then
+  echo "Reusing cached bundle ${cache_name}"
+  tar xzf "$cache_name"
+fi
+
+bundle "$@"
+
+if [ ! -f "$cache_name" ] && [ -n "$AMAZON_SECRET_ACCESS_KEY" ]; then
+  echo "Caching \`${bundle_path}' to S3"
+  tar czf "$cache_name" "$bundle_path"
+  script/s3-put "$cache_name" "${AMAZON_S3_BUCKET}:${TRAVIS_REPO_SLUG}/${cache_name}"
+fi
--- a/script/s3-put
+++ b/script/s3-put
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Usage: s3-put <FILE> <S3_BUCKET>[:<PATH>] [<CONTENT_TYPE>]
+#
+# Uploads a file to the Amazon S3 service.
+# Outputs the URL for the newly uploaded file.
+#
+# Requirements:
+# - AMAZON_ACCESS_KEY_ID
+# - AMAZON_SECRET_ACCESS_KEY
+# - openssl
+# - curl
+#
+# Author: Mislav Marohnić
+
+set -e
+
+authorization() {
+  local signature="$(string_to_sign | hmac_sha1 | base64)"
+  echo "AWS ${AMAZON_ACCESS_KEY_ID?}:${signature}"
+}
+
+hmac_sha1() {
+  openssl dgst -binary -sha1 -hmac "${AMAZON_SECRET_ACCESS_KEY?}"
+}
+
+base64() {
+  openssl enc -base64
+}
+
+bin_md5() {
+  openssl dgst -binary -md5
+}
+
+string_to_sign() {
+  echo "$http_method"
+  echo "$content_md5"
+  echo "$content_type"
+  echo "$date"
+  echo "x-amz-acl:$acl"
+  printf "/$bucket/$remote_path"
+}
+
+date_string() {
+  LC_TIME=C date "+%a, %d %h %Y %T %z"
+}
+
+file="$1"
+bucket="${2%%:*}"
+remote_path="${2#*:}"
+content_type="$3"
+
+if [ -z "$remote_path" ] || [ "$remote_path" = "$bucket" ]; then
+  remote_path="${file##*/}"
+fi
+
+http_method=PUT
+acl="public-read"
+content_md5="$(bin_md5 < "$file" | base64)"
+date="$(date_string)"
+
+url="https://$bucket.s3.amazonaws.com/$remote_path"
+
+curl -qsSf -T "$file" \
+  -H "Authorization: $(authorization)" \
+  -H "x-amz-acl: $acl" \
+  -H "Date: $date" \
+  -H "Content-MD5: $content_md5" \
+  -H "Content-Type: $content_type" \
+  "$url"
+
+echo "$url"
--- a/test/controllers/custom_registrations_controller_test.rb
+++ b/test/controllers/custom_registrations_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class CustomRegistrationsControllerTest < Devise::ControllerTestCase
+class CustomRegistrationsControllerTest < ActionController::TestCase
  tests Custom::RegistrationsController

  include Devise::TestHelpers
@@ -12,24 +12,24 @@ class CustomRegistrationsControllerTest < Devise::ControllerTestCase
  end

  test "yield resource to block on create success" do
-    post :create, params: { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
+    post :create, { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
    assert @controller.create_block_called?, "create failed to yield resource to provided block"
  end

  test "yield resource to block on create failure" do
-    post :create, params: { user: { } }
+    post :create, { user: { } }
    assert @controller.create_block_called?, "create failed to yield resource to provided block"
  end

  test "yield resource to block on update success" do
    sign_in @user
-    put :update, params: { user: { current_password: @password } }
+    put :update, { user: { current_password: @password } }
    assert @controller.update_block_called?, "update failed to yield resource to provided block"
  end

  test "yield resource to block on update failure" do
    sign_in @user
-    put :update, params: { user: { } }
+    put :update, { user: { } }
    assert @controller.update_block_called?, "update failed to yield resource to provided block"
  end

--- a/test/controllers/custom_strategy_test.rb
+++ b/test/controllers/custom_strategy_test.rb
@@ -24,7 +24,7 @@ class CustomStrategy < Warden::Strategies::Base
  end
 end

-class CustomStrategyTest < Devise::ControllerTestCase
+class CustomStrategyTest < ActionController::TestCase
  tests CustomStrategyController

  include Devise::TestHelpers
@@ -41,9 +41,8 @@ class CustomStrategyTest < Devise::ControllerTestCase
    ret = get :new

    # check the returned rack array
-    # assert ret.is_a?(Array)
-    # assert_equal 400, ret.first
-    assert ret.is_a?(ActionDispatch::TestResponse)
+    assert ret.is_a?(Array)
+    assert_equal 400, ret.first

    # check the saved response as well. This is purely so that the response is available to the testing framework
    # for verification. In production, the above array would be delivered directly to Rack.
@@ -54,9 +53,8 @@ class CustomStrategyTest < Devise::ControllerTestCase
    ret = get :new

    # check the returned rack array
-    # assert ret.is_a?(Array)
-    # assert_equal ret.third['X-FOO'], 'BAR'
-    assert ret.is_a?(ActionDispatch::TestResponse)
+    assert ret.is_a?(Array)
+    assert_equal ret.third['X-FOO'], 'BAR'

    # check the saved response headers as well.
    assert_equal response.headers['X-FOO'], 'BAR'
--- a/test/controllers/helper_methods_test.rb
+++ b/test/controllers/helper_methods_test.rb
@@ -4,15 +4,14 @@ class ApiController < ActionController::Metal
  include Devise::Controllers::Helpers
 end

-class HelperMethodsTest < Devise::ControllerTestCase
+class HelperMethodsTest < ActionController::TestCase
  tests ApiController

  test 'includes Devise::Controllers::Helpers' do
    assert_includes @controller.class.ancestors, Devise::Controllers::Helpers
  end

-  test 'does not respond_to helper or helper_method' do
-    refute_respond_to @controller.class, :helper
+  test 'does not respond_to helper_method' do
    refute_respond_to @controller.class, :helper_method
  end

--- a/test/controllers/helpers_test.rb
+++ b/test/controllers/helpers_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'
 require 'ostruct'

-class ControllerAuthenticatableTest < Devise::ControllerTestCase
+class ControllerAuthenticatableTest < ActionController::TestCase
  tests ApplicationController

  def setup
--- a/test/controllers/inherited_controller_i18n_messages_test.rb
+++ b/test/controllers/inherited_controller_i18n_messages_test.rb
@@ -14,7 +14,7 @@ class AnotherInheritedController < SessionsInheritedController
  end
 end

-class InheritedControllerTest < Devise::ControllerTestCase
+class InheritedControllerTest < ActionController::TestCase
  tests SessionsInheritedController

  def setup
@@ -32,7 +32,7 @@ class InheritedControllerTest < Devise::ControllerTestCase
  end
 end

-class AnotherInheritedControllerTest < Devise::ControllerTestCase
+class AnotherInheritedControllerTest < ActionController::TestCase
  tests AnotherInheritedController

  def setup
--- a/test/controllers/internal_helpers_test.rb
+++ b/test/controllers/internal_helpers_test.rb
@@ -3,7 +3,7 @@ require 'test_helper'
 class MyController < DeviseController
 end

-class HelpersTest < Devise::ControllerTestCase
+class HelpersTest < ActionController::TestCase
  tests MyController

  def setup
@@ -36,16 +36,18 @@ class HelpersTest < Devise::ControllerTestCase
  test 'get resource params from request params using resource name as key' do
    user_params = {'email' => 'shirley@templar.com'}

-    # Stub controller name so strong parameters can filter properly.
-    # DeviseController does not allow any parameters by default.
-    @controller.stubs(:controller_name).returns(:sessions_controller)
-
-    params = ActionController::Parameters.new({'user' => user_params})
+    params = if Devise.rails4?
+      # Stub controller name so strong parameters can filter properly.
+      # DeviseController does not allow any parameters by default.
+      @controller.stubs(:controller_name).returns(:sessions_controller)

+      ActionController::Parameters.new({'user' => user_params})
+    else
+      HashWithIndifferentAccess.new({'user' => user_params})
+    end
    @controller.stubs(:params).returns(params)

-    res_params = @controller.send(:resource_params).permit!.to_h
-    assert_equal user_params, res_params
+    assert_equal user_params, @controller.send(:resource_params)
  end

  test 'resources methods are not controller actions' do
--- a/test/controllers/load_hooks_controller_test.rb
+++ b/test/controllers/load_hooks_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class LoadHooksControllerTest < Devise::ControllerTestCase
+class LoadHooksControllerTest < ActionController::TestCase
  setup do
    ActiveSupport.on_load(:devise_controller) do
      define_method :defined_by_load_hook do
--- a/test/controllers/passwords_controller_test.rb
+++ b/test/controllers/passwords_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class PasswordsControllerTest < Devise::ControllerTestCase
+class PasswordsControllerTest < ActionController::TestCase
  tests Devise::PasswordsController
  include Devise::TestHelpers

@@ -11,9 +11,8 @@ class PasswordsControllerTest < Devise::ControllerTestCase
  end

  def put_update_with_params
-    put :update, params: { "user" => {
-        "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
-      }
+    put :update, "user" => {
+      "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
    }
  end

--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class SessionsControllerTest < Devise::ControllerTestCase
+class SessionsControllerTest < ActionController::TestCase
  tests Devise::SessionsController
  include Devise::TestHelpers

@@ -12,10 +12,9 @@ class SessionsControllerTest < Devise::ControllerTestCase
      request.env["devise.mapping"] = Devise.mappings[:user]
      request.session["user_return_to"] = 'foo.bar'
      create_user
-      post :create, params: { user: {
-          email: "wrong@email.com",
-          password: "wrongpassword"
-        }
+      post :create, user: {
+        email: "wrong@email.com",
+        password: "wrongpassword"
      }
      assert_equal 200, @response.status
    ensure
@@ -38,11 +37,11 @@ class SessionsControllerTest < Devise::ControllerTestCase

    user = create_user
    user.confirm
-    post :create, params: { user: {
-        email: user.email,
-        password: user.password
-      }
+    post :create, user: {
+      email: user.email,
+      password: user.password
    }
+
    assert_nil request.session["user_return_to"]
  end

@@ -52,10 +51,9 @@ class SessionsControllerTest < Devise::ControllerTestCase

    user = create_user
    user.confirm
-    post :create, params: { format: 'json', user: {
-        email: user.email,
-        password: user.password
-      }
+    post :create, format: 'json', user: {
+      email: user.email,
+      password: user.password
    }

    assert_equal 'foo.bar', request.session["user_return_to"]
@@ -63,10 +61,9 @@ class SessionsControllerTest < Devise::ControllerTestCase

  test "#create doesn't raise exception after Warden authentication fails when TestHelpers included" do
    request.env["devise.mapping"] = Devise.mappings[:user]
-    post :create, params: { user: {
-        email: "nosuchuser@example.com",
-        password: "wevdude"
-      }
+    post :create, user: {
+      email: "nosuchuser@example.com",
+      password: "wevdude"
    }
    assert_equal 200, @response.status
    assert_template "devise/sessions/new"
@@ -76,11 +73,11 @@ class SessionsControllerTest < Devise::ControllerTestCase
    request.env["devise.mapping"] = Devise.mappings[:user]
    user = create_user
    user.confirm
-    post :create, params: { format: 'json', user: {
-        email: user.email,
-        password: user.password
-      }
+    post :create, format: 'json', user: {
+      email: user.email,
+      password: user.password
    }
+
    delete :destroy, format: 'json'
    assert flash[:notice].blank?, "flash[:notice] should be blank, not #{flash[:notice].inspect}"
    assert_equal 204, @response.status
--- a/test/controllers/url_helpers_test.rb
+++ b/test/controllers/url_helpers_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class RoutesTest < Devise::ControllerTestCase
+class RoutesTest < ActionController::TestCase
  tests ApplicationController

  def assert_path_and_url(name, prepend_path=nil)
--- a/test/devise_test.rb
+++ b/test/devise_test.rb
@@ -35,33 +35,6 @@ class DeviseTest < ActiveSupport::TestCase
    end
  end

-  test 'setup block warns about defaults changing' do
-    Devise.app_set_configs = Set.new
-
-    ActiveSupport::Deprecation.expects(:warn).with() { |value| value =~ /email_regexp/ }
-    ActiveSupport::Deprecation.expects(:warn).with() { |value| value =~ /reconfirmable/ }
-    ActiveSupport::Deprecation.expects(:warn).with() { |value| value =~ /sign_out_via/ }
-    ActiveSupport::Deprecation.expects(:warn).with() { |value| value =~ /skip_session_storage/ }
-    ActiveSupport::Deprecation.expects(:warn).with() { |value| value =~ /strip_whitespace_keys/ }
-
-    Devise.setup do
-    end
-  end
-
-  test 'setup block doest not warns when the change is explicit set' do
-    ActiveSupport::Deprecation.expects(:warn).never
-
-    swap Devise,
-        email_regexp: /@/,
-        reconfirmable: false,
-        sign_out_via: :get,
-        skip_session_storage: [],
-        strip_whitespace_keys: [] do
-        Devise.setup do
-        end
-    end
-  end
-
  test 'stores warden configuration' do
    assert_kind_of Devise::Delegator, Devise.warden_config.failure_app
    assert_equal :user, Devise.warden_config.default_scope
--- a/test/failure_app_test.rb
+++ b/test/failure_app_test.rb
@@ -53,16 +53,11 @@ class FailureTest < ActiveSupport::TestCase
      'REQUEST_METHOD' => 'GET',
      'warden.options' => { scope: :user },
      'rack.session' => {},
-      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime[:html]),
+      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime::HTML),
      'rack.input' => "",
      'warden' => OpenStruct.new(message: nil)
    }.merge!(env_params)

-    # Passing nil for action_dispatch.request.formats prevents the default from being used in Rails 5, need to remove it
-    if env.has_key?('action_dispatch.request.formats') && env['action_dispatch.request.formats'].nil?
-      env.delete 'action_dispatch.request.formats' unless env['action_dispatch.request.formats']
-    end
-
    @response = (env.delete(:app) || Devise::FailureApp).call(env).to_a
    @request  = ActionDispatch::Request.new(env)
  end
@@ -160,7 +155,7 @@ class FailureTest < ActiveSupport::TestCase
      assert_equal 'text/html; charset=utf-8', @response.second['Content-Type']
    end

-    test 'set up a default message' do
+    test 'setup a default message' do
      call_failure
      assert_match(/You are being/, @response.last.body)
      assert_match(/redirected/, @response.last.body)
@@ -169,14 +164,14 @@ class FailureTest < ActiveSupport::TestCase

    test 'works for any navigational format' do
      swap Devise, navigational_formats: [:xml] do
-        call_failure('formats' => Mime[:xml])
+        call_failure('formats' => Mime::XML)
        assert_equal 302, @response.first
      end
    end

    test 'redirects the correct format if it is a non-html format request' do
      swap Devise, navigational_formats: [:js] do
-        call_failure('formats' => Mime[:js])
+        call_failure('formats' => Mime::JS)
        assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
      end
    end
@@ -184,18 +179,18 @@ class FailureTest < ActiveSupport::TestCase

  context 'For HTTP request' do
    test 'return 401 status' do
-      call_failure('formats' => Mime[:xml])
+      call_failure('formats' => Mime::XML)
      assert_equal 401, @response.first
    end

    test 'return appropriate body for xml' do
-      call_failure('formats' => Mime[:xml])
+      call_failure('formats' => Mime::XML)
      result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
      assert_equal result, @response.last.body
    end

    test 'return appropriate body for json' do
-      call_failure('formats' => Mime[:json])
+      call_failure('formats' => Mime::JSON)
      result = %({"error":"You need to sign in or sign up before continuing."})
      assert_equal result, @response.last.body
    end
@@ -206,26 +201,26 @@ class FailureTest < ActiveSupport::TestCase
    end

    test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => Mime[:xml])
+      call_failure('formats' => Mime::XML)
      assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
    end

    test 'does not return WWW-authenticate headers if model does not allow' do
      swap Devise, http_authenticatable: false do
-        call_failure('formats' => Mime[:xml])
+        call_failure('formats' => Mime::XML)
        assert_nil @response.second["WWW-Authenticate"]
      end
    end

    test 'works for any non navigational format' do
      swap Devise, navigational_formats: [] do
-        call_failure('formats' => Mime[:html])
+        call_failure('formats' => Mime::HTML)
        assert_equal 401, @response.first
      end
    end

    test 'uses the failure message as response body' do
-      call_failure('formats' => Mime[:xml], 'warden' => OpenStruct.new(message: :invalid))
+      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(message: :invalid))
      assert_match '<error>Invalid email or password.</error>', @response.third.body
    end

@@ -233,7 +228,7 @@ class FailureTest < ActiveSupport::TestCase
      context 'when http_authenticatable_on_xhr is false' do
        test 'dont return 401 with navigational formats' do
          swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 302, @response.first
            assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
          end
@@ -241,7 +236,7 @@ class FailureTest < ActiveSupport::TestCase

        test 'dont return 401 with non navigational formats' do
          swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime[:json], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 302, @response.first
            assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
          end
@@ -251,14 +246,14 @@ class FailureTest < ActiveSupport::TestCase
      context 'when http_authenticatable_on_xhr is true' do
        test 'return 401' do
          swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 401, @response.first
          end
        end

        test 'skip WWW-Authenticate header' do
          swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_nil @response.second['WWW-Authenticate']
          end
        end
--- a/test/generators/active_record_generator_test.rb
+++ b/test/generators/active_record_generator_test.rb
@@ -69,6 +69,7 @@ if DEVISE_ORM == :active_record
    setup :prepare_destination

    test "all files are properly created in rails 4.0" do
+      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(false)
      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
        run_generator ["monster"]

@@ -79,5 +80,30 @@ if DEVISE_ORM == :active_record
      end
    end

+    test "all files are properly created in rails 3.2 when strong_parameters gem is not installed" do
+      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
+      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(false)
+      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
+        run_generator ["monster"]
+
+        assert_file "app/models/rails_engine/monster.rb", /devise/
+        assert_file "app/models/rails_engine/monster.rb" do |content|
+          assert_match /attr_accessible :email/, content
+        end
+      end
+    end
+
+    test "all files are properly created in rails 3.2 when strong_parameters gem is installed" do
+      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
+      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(true)
+      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
+        run_generator ["monster"]
+
+        assert_file "app/models/rails_engine/monster.rb", /devise/
+        assert_file "app/models/rails_engine/monster.rb" do |content|
+          assert_no_match /attr_accessible :email/, content
+        end
+      end
+    end
  end
 end
--- a/test/generators/install_generator_test.rb
+++ b/test/generators/install_generator_test.rb
@@ -5,20 +5,9 @@ class InstallGeneratorTest < Rails::Generators::TestCase
  destination File.expand_path("../../tmp", __FILE__)
  setup :prepare_destination

-  test "assert all files are properly created" do
-    run_generator(["--orm=active_record"])
-    assert_file "config/initializers/devise.rb", /devise\/orm\/active_record/
+  test "Assert all files are properly created" do
+    run_generator
+    assert_file "config/initializers/devise.rb"
    assert_file "config/locales/devise.en.yml"
  end
-
-  test "fails if no ORM is specified" do
-    stderr = capture(:stderr) do
-      run_generator
-    end
-
-    assert_match %r{An ORM must be set to install Devise}, stderr
-
-    assert_no_file "config/initializers/devise.rb"
-    assert_no_file "config/locales/devise.en.yml"
-  end
 end
--- a/test/helpers/devise_helper_test.rb
+++ b/test/helpers/devise_helper_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class DeviseHelperTest < Devise::IntegrationTest
+class DeviseHelperTest < ActionDispatch::IntegrationTest
  setup do
    model_labels = { models: { user: "the user" } }
    translations = {
--- a/test/integration/authenticatable_test.rb
+++ b/test/integration/authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class AuthenticationSanityTest < Devise::IntegrationTest
+class AuthenticationSanityTest < ActionDispatch::IntegrationTest
  test 'home should be accessible without sign in' do
    visit '/'
    assert_response :success
@@ -134,7 +134,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest
  end
 end

-class AuthenticationRoutesRestrictions < Devise::IntegrationTest
+class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
  test 'not signed in should not be able to access private route (authenticate denied)' do
    get private_path
    assert_redirected_to new_admin_session_path
@@ -254,7 +254,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  end
 end

-class AuthenticationRedirectTest < Devise::IntegrationTest
+class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
  test 'redirect from warden shows sign in or sign up message' do
    get admins_path

@@ -300,7 +300,7 @@ class AuthenticationRedirectTest < Devise::IntegrationTest
  end

  test 'xml http requests does not store urls for redirect' do
-    get users_path, headers: { 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest' }
+    get users_path, {}, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest'
    assert_equal 401, response.status
    assert_nil session[:"user_return_to"]
  end
@@ -317,7 +317,7 @@ class AuthenticationRedirectTest < Devise::IntegrationTest
  end
 end

-class AuthenticationSessionTest < Devise::IntegrationTest
+class AuthenticationSessionTest < ActionDispatch::IntegrationTest
  test 'destroyed account is signed out' do
    sign_in_as_user
    get '/users'
@@ -390,7 +390,7 @@ class AuthenticationSessionTest < Devise::IntegrationTest
  end
 end

-class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
+class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
  test 'renders the scoped view if turned on and view is available' do
    swap Devise, scoped_views: true do
      assert_raise Webrat::NotFoundError do
@@ -431,7 +431,7 @@ class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
  end
 end

-class AuthenticationOthersTest < Devise::IntegrationTest
+class AuthenticationOthersTest < ActionDispatch::IntegrationTest
  test 'handles unverified requests gets rid of caches' do
    swap ApplicationController, allow_forgery_protection: true do
      post exhibit_user_url(1)
@@ -472,7 +472,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest

  test 'sign in with script name' do
    assert_nothing_raised do
-      get new_user_session_path, headers: { "SCRIPT_NAME" => "/omg" }
+      get new_user_session_path, {}, "SCRIPT_NAME" => "/omg"
      fill_in "email", with: "user@test.com"
    end
  end
@@ -509,7 +509,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest

  test 'sign in with xml format returns xml response' do
    create_user
-    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
+    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
  end
@@ -519,13 +519,13 @@ class AuthenticationOthersTest < Devise::IntegrationTest
    assert_response :success

    create_user
-    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
+    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
    assert_response :success

    get new_user_session_path(format: 'xml')
    assert_response :success

-    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
+    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
  end
@@ -559,7 +559,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
  test 'sign out with non-navigational format via XHR does not redirect' do
    swap Devise, navigational_formats: ['*/*', :html] do
      sign_in_as_user
-      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
+      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
      assert_response :no_content
      assert_not warden.authenticated?(:user)
    end
@@ -569,14 +569,14 @@ class AuthenticationOthersTest < Devise::IntegrationTest
  test 'sign out with navigational format via XHR does redirect' do
    swap Devise, navigational_formats: ['*/*', :html] do
      sign_in_as_user
-      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
+      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "text/html,*/*" }
      assert_response :redirect
      assert_not warden.authenticated?(:user)
    end
  end
 end

-class AuthenticationKeysTest < Devise::IntegrationTest
+class AuthenticationKeysTest < ActionDispatch::IntegrationTest
  test 'missing authentication keys cause authentication to abort' do
    swap Devise, authentication_keys: [:subdomain] do
      sign_in_as_user
@@ -593,7 +593,7 @@ class AuthenticationKeysTest < Devise::IntegrationTest
  end
 end

-class AuthenticationRequestKeysTest < Devise::IntegrationTest
+class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
  test 'request keys are used on authentication' do
    host! 'foo.bar.baz'

@@ -634,7 +634,7 @@ class AuthenticationRequestKeysTest < Devise::IntegrationTest
  end
 end

-class AuthenticationSignOutViaTest < Devise::IntegrationTest
+class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
  def sign_in!(scope)
    sign_in_as_admin(visit: send("new_#{scope}_session_path"))
    assert warden.authenticated?(scope)
@@ -689,7 +689,7 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
  end
 end

-class DoubleAuthenticationRedirectTest < Devise::IntegrationTest
+class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
  test 'signed in as user redirects when visiting user sign in page' do
    sign_in_as_user
    get new_user_session_path(format: :html)
@@ -712,7 +712,7 @@ class DoubleAuthenticationRedirectTest < Devise::IntegrationTest
  end
 end

-class DoubleSignOutRedirectTest < Devise::IntegrationTest
+class DoubleSignOutRedirectTest < ActionDispatch::IntegrationTest
  test 'sign out after already having signed out redirects to sign in' do
    sign_in_as_user

--- a/test/integration/confirmable_test.rb
+++ b/test/integration/confirmable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class ConfirmationTest < Devise::IntegrationTest
+class ConfirmationTest < ActionDispatch::IntegrationTest

  def visit_user_confirmation_with_token(confirmation_token)
    visit user_confirmation_path(confirmation_token: confirmation_token)
@@ -184,14 +184,14 @@ class ConfirmationTest < Devise::IntegrationTest

  test 'resent confirmation token with valid E-Mail in XML format should return valid response' do
    user = create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), params: { user: { email: user.email } }
+    post user_confirmation_path(format: 'xml'), user: { email: user.email }
    assert_response :success
    assert_equal response.body, {}.to_xml
  end

  test 'resent confirmation token with invalid E-Mail in XML format should return invalid response' do
    create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), params: { user: { email: 'invalid.test@test.com' } }
+    post user_confirmation_path(format: 'xml'), user: { email: 'invalid.test@test.com' }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -213,7 +213,7 @@ class ConfirmationTest < Devise::IntegrationTest
  test 'request an account confirmation account with JSON, should return an empty JSON' do
    user = create_user(confirm: false)

-    post user_confirmation_path, params: { user: { email: user.email }, format: :json }
+    post user_confirmation_path, user: { email: user.email }, format: :json
    assert_response :success
    assert_equal response.body, {}.to_json
  end
@@ -249,7 +249,7 @@ class ConfirmationTest < Devise::IntegrationTest
  end
 end

-class ConfirmationOnChangeTest < Devise::IntegrationTest
+class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
  def create_second_admin(options={})
    @admin = nil
    create_admin(options)
--- a/test/integration/database_authenticatable_test.rb
+++ b/test/integration/database_authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class DatabaseAuthenticationTest < Devise::IntegrationTest
+class DatabaseAuthenticationTest < ActionDispatch::IntegrationTest
  test 'sign in with email of different case should succeed when email is in the list of case insensitive keys' do
    create_user(email: 'Foo@Bar.com')

--- a/test/integration/http_authenticatable_test.rb
+++ b/test/integration/http_authenticatable_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'

-class HttpAuthenticationTest < Devise::IntegrationTest
+class HttpAuthenticationTest < ActionDispatch::IntegrationTest
  test 'handles unverified requests gets rid of caches but continues signed in' do
    swap ApplicationController, allow_forgery_protection: true do
      create_user
-      post exhibit_user_url(1), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}" }
+      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}"
      assert warden.authenticated?(:user)
      assert_equal "User is authenticated", response.body
    end
@@ -89,16 +89,17 @@ class HttpAuthenticationTest < Devise::IntegrationTest
  end

  private
+
    def sign_in_as_new_user_with_http(username="user@test.com", password="12345678")
      user = create_user
-      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}" }
+      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
      user
    end

    # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
    def add_oauth2_header
      user = create_user
-      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}" }
+      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}"
    end

 end
--- a/test/integration/lockable_test.rb
+++ b/test/integration/lockable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class LockTest < Devise::IntegrationTest
+class LockTest < ActionDispatch::IntegrationTest

  def visit_user_unlock_with_token(unlock_token)
    visit user_unlock_path(unlock_token: unlock_token)
@@ -132,10 +132,9 @@ class LockTest < Devise::IntegrationTest
    user = create_user(locked: true)
    ActionMailer::Base.deliveries.clear

-    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
+    post user_unlock_path(format: 'xml'), user: {email: user.email}
    assert_response :success
    assert_equal response.body, {}.to_xml
-
    assert_equal 1, ActionMailer::Base.deliveries.size
  end

@@ -143,7 +142,7 @@ class LockTest < Devise::IntegrationTest
    user = create_user(locked: false)
    ActionMailer::Base.deliveries.clear

-    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
+    post user_unlock_path(format: 'xml'), user: {email: user.email}
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
    assert_equal 0, ActionMailer::Base.deliveries.size
--- a/test/integration/omniauthable_test.rb
+++ b/test/integration/omniauthable_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'


-class OmniauthableIntegrationTest < Devise::IntegrationTest
+class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
  FACEBOOK_INFO = {
    "id" => '12345',
    "link" => 'http://facebook.com/josevalim',
--- a/test/integration/recoverable_test.rb
+++ b/test/integration/recoverable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class PasswordTest < Devise::IntegrationTest
+class PasswordTest < ActionDispatch::IntegrationTest

  def visit_new_password_path
    visit new_user_session_path
@@ -160,7 +160,8 @@ class PasswordTest < Devise::IntegrationTest
    assert_response :success
    assert_current_url '/users/password'
    assert_have_selector '#error_explanation'
-    assert_contain "Password confirmation doesn't match Password"
+    assert_contain Devise.rails4? ?
+      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
    assert_not user.reload.valid_password?('987654321')
  end

@@ -250,14 +251,14 @@ class PasswordTest < Devise::IntegrationTest

  test 'reset password request with valid E-Mail in XML format should return valid response' do
    create_user
-    post user_password_path(format: 'xml'), params: { user: {email: "user@test.com"} }
+    post user_password_path(format: 'xml'), user: {email: "user@test.com"}
    assert_response :success
    assert_equal response.body, { }.to_xml
  end

  test 'reset password request with invalid E-Mail in XML format should return valid response' do
    create_user
-    post user_password_path(format: 'xml'), params: { user: {email: "invalid.test@test.com"} }
+    post user_password_path(format: 'xml'), user: {email: "invalid.test@test.com"}
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -265,7 +266,7 @@ class PasswordTest < Devise::IntegrationTest
  test 'reset password request with invalid E-Mail in XML format should return empty and valid response' do
    swap Devise, paranoid: true do
      create_user
-      post user_password_path(format: 'xml'), params: { user: {email: "invalid@test.com"} }
+      post user_password_path(format: 'xml'), user: {email: "invalid@test.com"}
      assert_response :success
      assert_equal response.body, { }.to_xml
    end
@@ -274,9 +275,8 @@ class PasswordTest < Devise::IntegrationTest
  test 'change password with valid parameters in XML format should return valid response' do
    create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), params: { user: {
+    put user_password_path(format: 'xml'), user: {
      reset_password_token: 'abcdef', password: '987654321', password_confirmation: '987654321'
-      }
    }
    assert_response :success
    assert warden.authenticated?(:user)
@@ -285,7 +285,7 @@ class PasswordTest < Devise::IntegrationTest
  test 'change password with invalid token in XML format should return invalid response' do
    create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), params: { user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'} }
+    put user_password_path(format: 'xml'), user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'}
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -293,7 +293,7 @@ class PasswordTest < Devise::IntegrationTest
  test 'change password with invalid new password in XML format should return invalid response' do
    user = create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), params: { user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'} }
+    put user_password_path(format: 'xml'), user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'}
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -301,7 +301,7 @@ class PasswordTest < Devise::IntegrationTest
  test "when using json requests to ask a confirmable request, should not return the object" do
    user = create_user(confirm: false)

-    post user_password_path(format: :json), params: { user: { email: user.email } }
+    post user_password_path(format: :json), user: { email: user.email }

    assert_response :success
    assert_equal response.body, "{}"
--- a/test/integration/registerable_test.rb
+++ b/test/integration/registerable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class RegistrationTest < Devise::IntegrationTest
+class RegistrationTest < ActionDispatch::IntegrationTest

  test 'a guest admin should be able to sign in successfully' do
    get new_admin_session_path
@@ -110,7 +110,8 @@ class RegistrationTest < Devise::IntegrationTest
    assert_template 'registrations/new'
    assert_have_selector '#error_explanation'
    assert_contain "Email is invalid"
-    assert_contain "Password confirmation doesn't match Password"
+    assert_contain Devise.rails4? ?
+      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
    assert_contain "2 errors prohibited"
    assert_nil User.to_adapter.find_first

@@ -216,7 +217,8 @@ class RegistrationTest < Devise::IntegrationTest
    fill_in 'current password', with: '12345678'
    click_button 'Update'

-    assert_contain "Password confirmation doesn't match Password"
+    assert_contain Devise.rails4? ?
+      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
    assert_not User.to_adapter.find_first.valid_password?('pas123')
  end

@@ -257,7 +259,7 @@ class RegistrationTest < Devise::IntegrationTest
  end

  test 'an admin sign up with valid information in XML format should return valid response' do
-    post admin_registration_path(format: 'xml'), params: { admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
+    post admin_registration_path(format: 'xml'), admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<admin>)

@@ -266,7 +268,7 @@ class RegistrationTest < Devise::IntegrationTest
  end

  test 'a user sign up with valid information in XML format should return valid response' do
-    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
+    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)

@@ -275,21 +277,21 @@ class RegistrationTest < Devise::IntegrationTest
  end

  test 'a user sign up with invalid information in XML format should return invalid response' do
-    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' } }
+    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end

  test 'a user update information with valid data in XML format should return valid response' do
    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), params: { user: { current_password: '12345678', email: 'user.new@test.com' } }
+    put user_registration_path(format: 'xml'), user: { current_password: '12345678', email: 'user.new@test.com' }
    assert_response :success
    assert_equal user.reload.email, 'user.new@test.com'
  end

  test 'a user update information with invalid data in XML format should return invalid response' do
    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), params: { user: { current_password: 'invalid', email: 'user.new@test.com' } }
+    put user_registration_path(format: 'xml'), user: { current_password: 'invalid', email: 'user.new@test.com' }
    assert_response :unprocessable_entity
    assert_equal user.reload.email, 'user@test.com'
  end
@@ -302,7 +304,7 @@ class RegistrationTest < Devise::IntegrationTest
  end
 end

-class ReconfirmableRegistrationTest < Devise::IntegrationTest
+class ReconfirmableRegistrationTest < ActionDispatch::IntegrationTest
  test 'a signed in admin should see a more appropriate flash message when editing their account if reconfirmable is enabled' do
    sign_in_as_admin
    get edit_admin_registration_path
--- a/test/integration/rememberable_test.rb
+++ b/test/integration/rememberable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class RememberMeTest < Devise::IntegrationTest
+class RememberMeTest < ActionDispatch::IntegrationTest
  def create_user_and_remember(add_to_token='')
    user = create_user
    user.remember_me!
@@ -10,7 +10,7 @@ class RememberMeTest < Devise::IntegrationTest
  end

  def generate_signed_cookie(raw_cookie)
-    request = Devise.rails5? ? ActionDispatch::TestRequest.create : ActionDispatch::TestRequest.new
+    request = ActionDispatch::TestRequest.new
    request.cookie_jar.signed['raw_cookie'] = raw_cookie
    request.cookie_jar['raw_cookie']
  end
@@ -47,10 +47,8 @@ class RememberMeTest < Devise::IntegrationTest
      get new_user_session_path
      assert request.session[:_csrf_token]

-      post user_session_path, params: {
-          authenticity_token: "oops",
-          user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
-        }
+      post user_session_path, authenticity_token: "oops", user:
+           { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
      assert_not warden.authenticated?(:user)
      assert_not request.cookies['remember_user_token']
    end
@@ -94,6 +92,7 @@ class RememberMeTest < Devise::IntegrationTest
    assert_response :success
    assert warden.authenticated?(:user)
    assert warden.user(:user) == user
+    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
  end

  test 'remember the user before sign up and redirect them to their home' do
@@ -119,40 +118,6 @@ class RememberMeTest < Devise::IntegrationTest
    end
  end

-  test 'extends remember period when extend remember period config is true' do
-    swap Devise, extend_remember_period: true, remember_for: 1.year do
-      user = create_user_and_remember
-      old_remember_token = nil
-
-      travel_to 1.day.ago do
-        get root_path
-        old_remember_token = request.cookies['remember_user_token']
-      end
-
-      get root_path
-      current_remember_token = request.cookies['remember_user_token']
-
-      refute_equal old_remember_token, current_remember_token
-    end
-  end
-
-  test 'does not extend remember period when extend period config is false' do
-    swap Devise, extend_remember_period: false, remember_for: 1.year do
-      user = create_user_and_remember
-      old_remember_token = nil
-
-      travel_to 1.day.ago do
-        get root_path
-        old_remember_token = request.cookies['remember_user_token']
-      end
-
-      get root_path
-      current_remember_token = request.cookies['remember_user_token']
-
-      assert_equal old_remember_token, current_remember_token
-    end
-  end
-
  test 'do not remember other scopes' do
    create_user_and_remember
    get root_path
--- a/test/integration/timeoutable_test.rb
+++ b/test/integration/timeoutable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class SessionTimeoutTest < Devise::IntegrationTest
+class SessionTimeoutTest < ActionDispatch::IntegrationTest

  def last_request_at
    @controller.user_session['last_request_at']
@@ -20,7 +20,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
    old_last_request = last_request_at
    assert_not_nil last_request_at

-    get users_path, headers: { 'devise.skip_trackable' => true }
+    get users_path, {}, 'devise.skip_trackable' => true
    assert_equal old_last_request, last_request_at
  end

@@ -32,7 +32,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
    new_time = 2.seconds.from_now
    Time.stubs(:now).returns(new_time)

-    get users_path, headers: { 'devise.skip_timeoutable' => true }
+    get users_path, {}, 'devise.skip_timeoutable' => true
    assert_equal old_last_request, last_request_at
  end

@@ -115,7 +115,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
    user = sign_in_as_user
    get expire_user_path(user)

-    post "/users/sign_in", params: { email: user.email, password: "123456" }
+    post "/users/sign_in", email: user.email, password: "123456"

    assert_response :redirect
    follow_redirect!
--- a/test/integration/trackable_test.rb
+++ b/test/integration/trackable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class TrackableHooksTest < Devise::IntegrationTest
+class TrackableHooksTest < ActionDispatch::IntegrationTest

  test "current and last sign in timestamps are updated on each sign in" do
    user = create_user
--- a/test/mailers/confirmation_instructions_test.rb
+++ b/test/mailers/confirmation_instructions_test.rb
@@ -37,16 +37,16 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
    assert_equal [user.email], mail.to
  end

-  test 'set up sender from configuration' do
+  test 'setup sender from configuration' do
    assert_equal ['test@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults' do
+  test 'setup sender from custom mailer defaults' do
    Devise.mailer = 'Users::Mailer'
    assert_equal ['custom@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults with proc' do
+  test 'setup sender from custom mailer defaults with proc' do
    Devise.mailer = 'Users::FromProcMailer'
    assert_equal ['custom@example.com'], mail.from
  end
@@ -56,17 +56,17 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
    assert_present mail.body.encoded
  end

-  test 'set up reply to as copy from sender' do
+  test 'setup reply to as copy from sender' do
    assert_equal ['test@example.com'], mail.reply_to
  end

-  test 'set up reply to as different if set in defaults' do
+  test 'setup reply to as different if set in defaults' do
    Devise.mailer = 'Users::ReplyToMailer'
    assert_equal ['custom@example.com'], mail.from
    assert_equal ['custom_reply_to@example.com'], mail.reply_to
  end

-  test 'set up subject from I18n' do
+  test 'setup subject from I18n' do
    store_translations :en, devise: { mailer: { confirmation_instructions: { subject: 'Account Confirmation' } } } do
      assert_equal 'Account Confirmation', mail.subject
    end
--- a/test/mailers/reset_password_instructions_test.rb
+++ b/test/mailers/reset_password_instructions_test.rb
@@ -39,16 +39,16 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
    assert_equal [user.email], mail.to
  end

-  test 'set up sender from configuration' do
+  test 'setup sender from configuration' do
    assert_equal ['test@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults' do
+  test 'setup sender from custom mailer defaults' do
    Devise.mailer = 'Users::Mailer'
    assert_equal ['custom@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults with proc' do
+  test 'setup sender from custom mailer defaults with proc' do
    Devise.mailer = 'Users::FromProcMailer'
    assert_equal ['custom@example.com'], mail.from
  end
@@ -58,11 +58,11 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
    assert_present mail.body.encoded
  end

-  test 'set up reply to as copy from sender' do
+  test 'setup reply to as copy from sender' do
    assert_equal ['test@example.com'], mail.reply_to
  end

-  test 'set up subject from I18n' do
+  test 'setup subject from I18n' do
    store_translations :en, devise: { mailer: { reset_password_instructions: { subject: 'Reset instructions' } } } do
      assert_equal 'Reset instructions', mail.subject
    end
--- a/test/mailers/unlock_instructions_test.rb
+++ b/test/mailers/unlock_instructions_test.rb
@@ -40,16 +40,16 @@ class UnlockInstructionsTest < ActionMailer::TestCase
    assert_equal [user.email], mail.to
  end

-  test 'set up sender from configuration' do
+  test 'setup sender from configuration' do
    assert_equal ['test@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults' do
+  test 'setup sender from custom mailer defaults' do
    Devise.mailer = 'Users::Mailer'
    assert_equal ['custom@example.com'], mail.from
  end

-  test 'set up sender from custom mailer defaults with proc' do
+  test 'setup sender from custom mailer defaults with proc' do
    Devise.mailer = 'Users::FromProcMailer'
    assert_equal ['custom@example.com'], mail.from
  end
@@ -59,11 +59,11 @@ class UnlockInstructionsTest < ActionMailer::TestCase
    assert_present mail.body.encoded
  end

-  test 'set up reply to as copy from sender' do
+  test 'setup reply to as copy from sender' do
    assert_equal ['test@example.com'], mail.reply_to
  end

-  test 'set up subject from I18n' do
+  test 'setup subject from I18n' do
    store_translations :en, devise: { mailer: { unlock_instructions:  { subject: 'Yo unlock instructions' } } } do
      assert_equal 'Yo unlock instructions', mail.subject
    end
--- a/test/models/confirmable_test.rb
+++ b/test/models/confirmable_test.rb
@@ -114,7 +114,7 @@ class ConfirmableTest < ActiveSupport::TestCase

    assert_email_not_sent do
      user.save!
-      assert_not user.confirmed?
+      assert !user.confirmed?
    end
  end

@@ -188,7 +188,7 @@ class ConfirmableTest < ActiveSupport::TestCase

  test 'confirm time should fallback to devise confirm in default configuration' do
    swap Devise, allow_unconfirmed_access_for: 1.day do
-      user = create_user
+      user = new_user
      user.confirmation_sent_at = 2.days.ago
      assert_not user.active_for_authentication?

@@ -256,7 +256,7 @@ class ConfirmableTest < ActiveSupport::TestCase
      user.instance_eval { def confirmation_required?; false end }
      user.confirmation_sent_at = nil
      user.save
-      assert user.reload.confirm
+      assert user.reload.confirm!
    end
  end

@@ -401,14 +401,6 @@ class ReconfirmableTest < ActiveSupport::TestCase
    assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
  end

-  test 'should send confirmation instructions by email after changing email from nil' do
-    admin = create_admin(email: nil)
-    assert_email_sent "new_test@example.com" do
-      assert admin.update_attributes(email: 'new_test@example.com')
-    end
-    assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
-  end
-
  test 'should not send confirmation by email after changing password' do
    admin = create_admin
    assert admin.confirm
@@ -496,8 +488,8 @@ class ReconfirmableTest < ActiveSupport::TestCase
  end

  test 'should not require reconfirmation after creating a record' do
-    admin = create_admin
-    assert !admin.pending_reconfirmation?
+    user = create_admin
+    assert !user.pending_reconfirmation?
  end

  test 'should not require reconfirmation after creating a record with #save called in callback' do
@@ -505,7 +497,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
      after_create :save
    end

-    admin = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
-    assert !admin.pending_reconfirmation?
+    user = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
+    assert !user.pending_reconfirmation?
  end
 end
--- a/test/models/database_authenticatable_test.rb
+++ b/test/models/database_authenticatable_test.rb
@@ -92,28 +92,28 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
    assert user.respond_to?(:password_confirmation)
  end

-  test 'should generate a hashed password while setting password' do
+  test 'should generate encrypted password while setting password' do
    user = new_user
    assert_present user.encrypted_password
  end

-  test 'should support custom hashing methods' do
-    user = UserWithCustomHashing.new(password: '654321')
+  test 'should support custom encryption methods' do
+    user = UserWithCustomEncryption.new(password: '654321')
    assert_equal user.encrypted_password, '123456'
  end

-  test 'allow authenticatable_salt to work even with nil hashed password' do
+  test 'allow authenticatable_salt to work even with nil encrypted password' do
    user = User.new
    user.encrypted_password = nil
    assert_nil user.authenticatable_salt
  end

-  test 'should not generate a hashed password if password is blank' do
+  test 'should not generate encrypted password if password is blank' do
    assert_blank new_user(password: nil).encrypted_password
    assert_blank new_user(password: '').encrypted_password
  end

-  test 'should hash password again if password has changed' do
+  test 'should encrypt password again if password has changed' do
    user = create_user
    encrypted_password = user.encrypted_password
    user.password = user.password_confirmation = 'new_password'
--- a/test/models/rememberable_test.rb
+++ b/test/models/rememberable_test.rb
@@ -37,7 +37,7 @@ class RememberableTest < ActiveSupport::TestCase
    id, token, date = User.serialize_into_cookie(user)
    assert_equal id, user.to_key
    assert_equal token, user.authenticatable_salt
-    assert date.is_a?(String)
+    assert date.is_a?(Time)
  end

  test 'serialize from cookie' do
@@ -46,18 +46,6 @@ class RememberableTest < ActiveSupport::TestCase
    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt, Time.now.utc)
  end

-  test 'serialize from cookie should accept a String with the datetime seconds and microseconds' do
-    user = create_user
-    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt, Time.now.utc.to_f.to_json)
-  end
-
-  test 'serialize from cookie should return nil with invalid datetime' do
-    user = create_user
-    user.remember_me!
-    assert_nil User.serialize_from_cookie(user.to_key, user.authenticatable_salt, "2013")
-  end
-
  test 'serialize from cookie should return nil if no resource is found' do
    assert_nil resource_class.serialize_from_cookie([0], "123", Time.now.utc)
  end
--- a/test/models/validatable_test.rb
+++ b/test/models/validatable_test.rb
@@ -57,7 +57,11 @@ class ValidatableTest < ActiveSupport::TestCase
    user = new_user(password: 'new_password', password_confirmation: 'blabla')
    assert user.invalid?

-    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
+    if Devise.rails4?
+      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
+    else
+      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
+    end
  end

  test 'should require password when updating/resetting password' do
@@ -75,7 +79,11 @@ class ValidatableTest < ActiveSupport::TestCase
    user.password_confirmation = 'another_password'
    assert user.invalid?

-    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
+    if Devise.rails4?
+      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
+    else
+      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
+    end
  end

  test 'should require a password with minimum of 7 characters' do
--- a/test/omniauth/url_helpers_test.rb
+++ b/test/omniauth/url_helpers_test.rb
@@ -1,21 +1,24 @@
 require 'test_helper'

 class OmniAuthRoutesTest < ActionController::TestCase
+  ExpectedUrlGeneratiorError = Devise.rails4? ?
+    ActionController::UrlGenerationError : ActionController::RoutingError
+
  tests ApplicationController

  def assert_path(action, provider, with_param=true)
    # Resource param
    assert_equal @controller.send(action, :user, provider),
-                 @controller.send("user_#{provider}_#{action}")
+                 @controller.send("user_#{action}", provider)

    # With an object
    assert_equal @controller.send(action, User.new, provider),
-                 @controller.send("user_#{provider}_#{action}")
+                 @controller.send("user_#{action}", provider)

    if with_param
      # Default url params
      assert_equal @controller.send(action, :user, provider, param: 123),
-                   @controller.send("user_#{provider}_#{action}", param: 123)
+                   @controller.send("user_#{action}", provider, param: 123)
    end
  end

@@ -30,7 +33,7 @@ class OmniAuthRoutesTest < ActionController::TestCase
  test 'should generate authorization path' do
    assert_match "/users/auth/facebook", @controller.omniauth_authorize_path(:user, :facebook)

-    assert_raise NoMethodError do
+    assert_raise ExpectedUrlGeneratiorError do
      @controller.omniauth_authorize_path(:user, :github)
    end
  end
--- a/test/orm/active_record.rb
+++ b/test/orm/active_record.rb
@@ -5,11 +5,6 @@ ActiveRecord::Base.include_root_in_json = true
 ActiveRecord::Migrator.migrate(File.expand_path("../../rails_app/db/migrate/", __FILE__))

 class ActiveSupport::TestCase
-  if Rails.version >= '5.0.0'
-    self.use_transactional_tests = true
-  else
-    self.use_transactional_fixtures = true
-  end
-
+  self.use_transactional_fixtures = true
  self.use_instantiated_fixtures  = false
 end
--- a/test/parameter_sanitizer_test.rb
+++ b/test/parameter_sanitizer_test.rb
@@ -1,131 +1,81 @@
 require 'test_helper'
 require 'devise/parameter_sanitizer'

-class ParameterSanitizerTest < ActiveSupport::TestCase
+class BaseSanitizerTest < ActiveSupport::TestCase
  def sanitizer(params)
-    params = ActionController::Parameters.new(params)
-    Devise::ParameterSanitizer.new(User, :user, params)
+    Devise::BaseSanitizer.new(User, :user, params)
  end

-  test 'permits the default parameters for sign in' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose' })
-    sanitized = sanitizer.sanitize(:sign_in)
-
-    assert_equal({ 'email' => 'jose' }, sanitized)
-  end
-
-  test 'permits the default parameters for sign up' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
-    sanitized = sanitizer.sanitize(:sign_up)
-
-    assert_equal({ 'email' => 'jose' }, sanitized)
-  end
-
-  test 'permits the default parameters for account update' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
-    sanitized = sanitizer.sanitize(:account_update)
-
-    assert_equal({ 'email' => 'jose' }, sanitized)
-  end
-
-  test 'permits news parameters for an existing action' do
-    sanitizer = sanitizer('user' => { 'username' => 'jose' })
-    sanitizer.permit(:sign_in, keys: [:username])
-    sanitized = sanitizer.sanitize(:sign_in)
-
-    assert_equal({ 'username' => 'jose' }, sanitized)
-  end
-
-  test 'permits news parameters for an existing action with a block' do
-    sanitizer = sanitizer('user' => { 'username' => 'jose' })
-    sanitizer.permit(:sign_in) do |user|
-      user.permit(:username)
-    end
-
-    sanitized = sanitizer.sanitize(:sign_in)
-
-    assert_equal({ 'username' => 'jose' }, sanitized)
-  end
-
-  test 'permit parameters for new actions' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'name' => 'Jose' })
-    sanitizer.permit(:invite_user, keys: [:email, :name])
-
-    sanitized = sanitizer.sanitize(:invite_user)
-
-    assert_equal({ 'email' => 'jose@omglol', 'name' => 'Jose' }, sanitized)
-  end
-
-  test 'fails when we do not have any permitted parameters for the action' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid' })
-
-    assert_raise NotImplementedError do
-      sanitizer.sanitize(:unknown)
-    end
-  end
-
-  test 'removes permitted parameters' do
-    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'username' => 'jose' })
-
-    sanitizer.permit(:sign_in, keys: [:username], except: [:email])
-    sanitized = sanitizer.sanitize(:sign_in)
-
-    assert_equal({ 'username' => 'jose' }, sanitized)
+  test 'returns chosen params' do
+    sanitizer = sanitizer(user: { "email" => "jose" })
+    assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_in))
  end
 end

-class DeprecatedParameterSanitizerAPITest < ActiveSupport::TestCase
-  class CustomSanitizer < Devise::ParameterSanitizer
-    def sign_in
-      default_params.permit(:username)
+if defined?(ActionController::StrongParameters)
+  require 'active_model/forbidden_attributes_protection'
+
+  class ParameterSanitizerTest < ActiveSupport::TestCase
+    def sanitizer(params)
+      params = ActionController::Parameters.new(params)
+      Devise::ParameterSanitizer.new(User, :user, params)
    end
-  end

-  def sanitizer(params)
-    params = ActionController::Parameters.new(params)
-    Devise::ParameterSanitizer.new(User, :user, params)
-  end
-
-  test 'overriding instance methods have precedence over the default sanitized attributes' do
-    assert_deprecated do
-      params =  ActionController::Parameters.new(user: { "username" => "jose", "name" => "Jose" })
-      sanitizer = CustomSanitizer.new(User, :user, params)
-
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ "username" => "jose" }, sanitized)
+    test 'filters some parameters on sign in by default' do
+      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
+      assert_equal({ "email" => "jose", "password" => "invalid", "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
    end
-  end

-  test 'adding new parameters by mutating the Array' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'username' => 'jose' })
-      sanitizer.for(:sign_in) << :username
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ 'username' => 'jose' }, sanitized)
+    test 'handles auth keys as a hash' do
+      swap Devise, authentication_keys: {email: true} do
+        sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
+        assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
+      end
    end
-  end

-   test 'adding new parameters with a block' do
-     assert_deprecated do
-       sanitizer = sanitizer('user' => { 'username' => 'jose' })
-       sanitizer.for(:sign_in) { |user| user.permit(:username) }
+    test 'filters some parameters on sign up by default' do
+      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
+      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_up))
+    end

-       sanitized = sanitizer.sanitize(:sign_in)
+    test 'filters some parameters on account update by default' do
+      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
+      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:account_update))
+    end

-       assert_equal({ 'username' => 'jose' }, sanitized)
-     end
-   end
+    test 'allows custom hooks' do
+      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
+      sanitizer.for(:sign_in) { |user| user.permit(:email, :password) }
+      assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
+    end

-  test 'removing multiple default parameters' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid', 'remember_me' => '1' })
+    test 'adding multiple permitted parameters' do
+      sanitizer = sanitizer(user: { "email" => "jose", "username" => "jose1", "role" => "valid" })
+      sanitizer.for(:sign_in).concat([:username, :role])
+      assert_equal({ "email" => "jose", "username" => "jose1", "role" => "valid" }, sanitizer.sanitize(:sign_in))
+    end
+
+    test 'removing multiple default parameters' do
+      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
      sanitizer.for(:sign_in).delete(:email)
      sanitizer.for(:sign_in).delete(:password)
-      sanitized = sanitizer.sanitize(:sign_in)
+      assert_equal({ "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
+    end

-      assert_equal({ 'remember_me' => '1' }, sanitized)
+    test 'raises on unknown hooks' do
+      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
+      assert_raise NotImplementedError do
+        sanitizer.sanitize(:unknown)
+      end
+    end
+
+    test 'passes parameters to filter as arguments to sanitizer' do
+      params = {user: stub}
+      sanitizer = Devise::ParameterSanitizer.new(User, :user, params)
+
+      params[:user].expects(:permit).with(kind_of(Symbol), kind_of(Symbol), kind_of(Symbol))
+
+      sanitizer.sanitize(:sign_in)
    end
  end
 end
--- a/test/rails_app/app/active_record/user.rb
+++ b/test/rails_app/app/active_record/user.rb
@@ -3,5 +3,4 @@ require 'shared_user'
 class User < ActiveRecord::Base
  include Shim
  include SharedUser
-  include ActiveModel::Serializers::Xml if Devise.rails5?
 end
--- a/test/rails_app/app/controllers/admins_controller.rb
+++ b/test/rails_app/app/controllers/admins_controller.rb
@@ -1,5 +1,5 @@
 class AdminsController < ApplicationController
-  before_action :authenticate_admin!
+  before_filter :authenticate_admin!

  def index
  end
--- a/test/rails_app/app/controllers/application_controller.rb
+++ b/test/rails_app/app/controllers/application_controller.rb
@@ -3,8 +3,8 @@

 class ApplicationController < ActionController::Base
  protect_from_forgery
-  before_action :current_user, unless: :devise_controller?
-  before_action :authenticate_user!, if: :devise_controller?
+  before_filter :current_user, unless: :devise_controller?
+  before_filter :authenticate_user!, if: :devise_controller?
  respond_to *Mime::SET.map(&:to_sym)

  devise_group :commenter, contains: [:user, :admin]
--- a/test/rails_app/app/controllers/home_controller.rb
+++ b/test/rails_app/app/controllers/home_controller.rb
@@ -20,10 +20,6 @@ class HomeController < ApplicationController
  end

  def unauthenticated
-    if Devise.rails5?
-      render body: "unauthenticated", status: :unauthorized
-    else
-      render text: "unauthenticated", status: :unauthorized
-    end
+    render text: "unauthenticated", status: :unauthorized
  end
 end
--- a/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
+++ b/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
@@ -1,6 +1,6 @@
 class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def facebook
-    data = request.respond_to?(:get_header) ? request.get_header("omniauth.auth") : env["omniauth.auth"]
+    data = env["omniauth.auth"]
    session["devise.facebook_data"] = data["extra"]["user_hash"]
    render json: data
  end
@@ -9,6 +9,6 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
    user = User.to_adapter.find_first(email: 'user@test.com')
    user.remember_me = true
    sign_in user
-    render (Devise.rails5? ? :body : :text) => ""
+    render text: ""
  end
 end
--- a/test/rails_app/app/controllers/users_controller.rb
+++ b/test/rails_app/app/controllers/users_controller.rb
@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
-  prepend_before_action :current_user, only: :exhibit
-  before_action :authenticate_user!, except: [:accept, :exhibit]
+  prepend_before_filter :current_user, only: :exhibit
+  before_filter :authenticate_user!, except: [:accept, :exhibit]
  respond_to :html, :xml

  def index
@@ -13,7 +13,7 @@ class UsersController < ApplicationController
  end

  def update_form
-    render (Devise.rails5? ? :body : :text) => 'Update'
+    render text: 'Update'
  end

  def accept
@@ -21,11 +21,11 @@ class UsersController < ApplicationController
  end

  def exhibit
-    render (Devise.rails5? ? :body : :text) => current_user ? "User is authenticated" : "User is not authenticated"
+    render text: current_user ? "User is authenticated" : "User is not authenticated"
  end

  def expire
    user_session['last_request_at'] = 31.minutes.ago.utc
-    render (Devise.rails5? ? :body : :text) => 'User will be expired on next request'
+    render text: 'User will be expired on next request'
  end
 end
--- a/test/rails_app/config/application.rb
+++ b/test/rails_app/config/application.rb
@@ -28,7 +28,7 @@ module RailsApp

    # Configure sensitive parameters which will be filtered from the log file.
    config.filter_parameters << :password
-    # config.assets.enabled = false
+    config.assets.enabled = false

    config.action_mailer.default_url_options = { host: "localhost", port: 3000 }

--- a/test/rails_app/config/boot.rb
+++ b/test/rails_app/config/boot.rb
@@ -3,12 +3,12 @@ unless defined?(DEVISE_ORM)
 end

 module Devise
-  # Detection for minor differences between Rails 4 and 5 in tests.
-  def self.rails5?
-    Rails.version.start_with? '5'
+  # Detection for minor differences between Rails 3.2 and 4 in tests.
+  def self.rails4?
+    Rails.version.start_with? '4'
  end
 end

 # Set up gems listed in the Gemfile.
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
-require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
+require 'bundler/setup' if File.exists?(ENV['BUNDLE_GEMFILE'])
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
José Valim	8cbdeb54a5	Release v3.5.5	2016-01-22 20:22:34 +01:00
José Valim	14affc8a55	Do not timeout if remember me is enabled	2016-01-22 16:18:57 +01:00
José Valim	eb0f0b662f	Readd remember_expired?	2016-01-22 15:57:57 +01:00
José Valim	1516a0ae6d	Release v3.5.4	2016-01-18 15:12:07 +01:00
José Valim	c92996646a	Store creation timestamp on remember cookies Signed-off-by: José Valim <jose.valim@plataformatec.com.br>	2016-01-18 14:47:31 +01:00
Kacper Walanus	ba5dd0a41a	test for save in after_create hook breaks devise confirmation [3787]	2015-12-15 11:41:48 -02:00
Christian Macias	f63be5039a	changed email_was !='' to email_was.present?	2015-12-15 11:41:33 -02:00
Christian Macias	f25562fd4b	fix for #3787 , save in after_create hook breaks devise confirmation	2015-12-15 11:41:33 -02:00
Siva Gollapalli	2a2fd806a8	FIX# Comparing times in UTC	2015-12-15 11:40:59 -02:00