title: Getting Devise AJAX sign in working with confirmable
body: <p>We're trying to extend Devise (3.1.1) signin/signup methods to handle AJAX requests, but are getting stuck with the confirmable logic. Normally, if a user signs in to Devise before confirming their account, they'll get redirected to the login screen with the flash message: <em>"You have to confirm your account before continuing."</em> We can't figure out where Devise is checking for confirmation and making the decision to redirect.</p>
  
  <p>Here's our extended <strong>sessions_controller</strong> code. It works fine for successful and failed login attempts: </p>
  
  <pre><code>  # CUSTOM (Mix of actual devise controller method and ajax customization from http://natashatherobot.com/devise-rails-sign-in/):
    def create
      # (NOTE: If user is not confirmed, execution will never get this far...)
      respond_to do |format|
        format.html do 
          # Copied from original create method:
          self.resource = warden.authenticate!(auth_options)
          set_flash_message(:notice, :signed_in) if is_navigational_format?
          sign_in(resource_name, resource)
          respond_with resource, :location =&gt; after_sign_in_path_for(resource)
        end                       
        format.js  do
          # Derived from Natasha AJAX recipe:
          self.resource = warden.authenticate!(:scope =&gt; resource_name, :recall =&gt; "#{controller_path}#failure")
          sign_in(resource_name, resource)
          return render :json =&gt; {:success =&gt; true, :token =&gt; form_authenticity_token() }, content_type: "application/json" # Need to explicitely set content type to JSON, otherwise it gets set as application/javascript and success handler never gets hit.
        end          
      end
  
    end
  
    def failure
      return render :json =&gt; {:success =&gt; false, :errors =&gt; ["Login failed."]}
    end
  </code></pre>
  
  <p>The problem is, if a user is unconfirmed, the <code>create</code> method never gets hit. The redirection happens somewhere before, which means we can't handle it in a JS friendly manner. But looking through the source I can't find any before filter that does a confirmable check. Where is the confirmable check happening and how can we intercept it?</p>