Add http_authenticatable_on_xhr option

Signed-off-by: José Valim <jose.valim@gmail.com>

lib/devise.rb

@@ -69,6 +69,10 @@ module Devise
   mattr_accessor :http_authenticatable
   @@http_authenticatable = true
 
+  # If http authentication is used for ajax requests.  True by default.
+  mattr_accessor :http_authenticatable_on_xhr
+  @@http_authenticatable_on_xhr = true
+
   # If params authenticatable is enabled by default.
   mattr_accessor :params_authenticatable
   @@params_authenticatable = true

lib/devise/failure_app.rb

@@ -68,7 +68,7 @@ module Devise
     end
 
     def http_auth?
-      !Devise.navigational_formats.include?(request.format.to_sym) || request.xhr?
+      !Devise.navigational_formats.include?(request.format.to_sym) || (request.xhr? && Devise.http_authenticatable_on_xhr)
     end
 
     def http_auth_body

lib/generators/devise/templates/devise.rb

@@ -28,6 +28,9 @@ Devise.setup do |config|
   # Tell if authentication through HTTP Basic Auth is enabled. True by default.
   # config.http_authenticatable = true
 
+  # Set this to true to use Basic Auth for AJAX requests.  True by default.
+  # config.http_authenticatable_on_xhr = true
+
   # The realm used in Http Basic Authentication
   # config.http_authentication_realm = "Application"