title: Unable to integrate lockable for number of failed attempts into Rails app
body: <p>I am new to rails+angular. For my app, I want to lock out user after 5 failed password attempts. I decided to follow this:
  <a href="https://stackoverflow.com/questions/11910176/how-to-make-devise-lockable-with-number-of-failed-attempts">How to make Devise lockable with number of failed attempts</a></p>
  
  <p>But when I try logging in after 5 failed attempts, it lets me through</p>
  
  <p>I added the :locked module to my user.rb (shown below) file so that the locked feature appears in devise.rb</p>
  
  <p>User.rb</p>
  
  <pre><code>class User &lt; ActiveRecord::Base
    include TokenAuthenticatable
  
    TYPE = { 
      :admin =&gt; 1,
      :member =&gt; 2
    }  
  
    devise :database_authenticatable, :registerable, :recoverable, 
           :rememberable, :trackable, :validatable, :token_authenticatable,
           :timeoutable, :lockable ##this was added
  
    has_and_belongs_to_many :clients
  end
  </code></pre>
  
  <p>In my migrations then, I un-commented out the lockable part of it :</p>
  
  <pre><code>class DeviseCreateUsers &lt; ActiveRecord::Migration
    def change
      create_table(:users) do |t|
        t.string :first_name
        t.string :last_name
        t.string :type
  
        ## Database authenticatable
        t.string :email,              :null =&gt; false, :default =&gt; ""
        t.string :encrypted_password, :null =&gt; false, :default =&gt; ""
  
        ## Recoverable
        t.string   :reset_password_token
        t.datetime :reset_password_sent_at
  
        ## Rememberable
        t.datetime :remember_created_at
  
        ## Trackable
        t.integer  :sign_in_count, :default =&gt; 0
        t.datetime :current_sign_in_at
        t.datetime :last_sign_in_at
        t.string   :current_sign_in_ip
        t.string   :last_sign_in_ip
  
        ## Confirmable
        # t.string   :confirmation_token
        # t.datetime :confirmed_at
        # t.datetime :confirmation_sent_at
        # t.string   :unconfirmed_email # Only if using reconfirmable
  
        ## Lockable
         t.integer  :failed_attempts, :default =&gt; 0 # Only if lock strategy is :failed_attempts
         t.string   :unlock_token # Only if unlock strategy is :email or :both
         t.datetime :locked_at
  
        ## Token authenticatable
        # t.string :authentication_token
  
  
        t.timestamps
      end
  
      add_index :users, :email,                :unique =&gt; true
      add_index :users, :reset_password_token, :unique =&gt; true
      # add_index :users, :confirmation_token,   :unique =&gt; true
      # add_index :users, :unlock_token,         :unique =&gt; true
      # add_index :users, :authentication_token, :unique =&gt; true
        end
      end
  </code></pre>
  
  <p>To troubleshoot this, I also tried adding <code>:locked, :failed_attempts =&gt; 5</code>and uncommented out all the lockable features in initializer/devise. I am unsure on how to proceed - help would be appreciated.</p>