Unit test for Lockable#unauthenticated_message not leaking account existence

This is another failing test for #1994, a unit test for Lockable. Lockable's
#uanauthenticated_message should not return :locked if paranoid mode is on
and instead should return the generic :invalid response.

test/models/lockable_test.rb

@@ -260,4 +260,14 @@ class LockableTest < ActiveSupport::TestCase
       end
     end
   end
+
+  test 'should not return a locked unauthenticated message if in paranoid mode' do
+    swap Devise, :paranoid => :true do
+      user = create_user
+      user.failed_attempts = Devise.maximum_attempts + 1
+      user.lock_access!
+
+      assert_equal :invalid, user.unauthenticated_message
+    end
+  end
 end