title: Devise with jwt - recoverable reset_password_by_token
body: <p>I'm working on a Rails API which will authenticate by means of a jwt, and would like the user accounts to be recoverable. Presumably, after receiving their reset token by email, users would supply their new password and the token with a PUT to <code>https://example.com/users/password</code>, to be handled by <code>/app/controllers/users/passwords_controller#update</code>. At present I've got this in <code>passwords_controller.rb</code> (mostly as in the default Devise code):</p>
  
  <pre><code>  # PUT /resource/password
    def update
      # {"user": {"password": "secret", "password_confirmation": "secret", "reset_password_token": "token_goes_here"}}
      self.resource = resource_class.reset_password_by_token(resource_params) # problem here (line 33)...
      yield resource if block_given?
  
      if resource.errors.empty?
        resource.unlock_access! if unlockable?(resource)
        if Devise.sign_in_after_reset_password
          resource.after_database_authentication
          auth_options = {user: {login: resource.username, password: params['user']['password']}}
          warden.authenticate!(auth_options)
          render json: {success: true, jwt: current_token, response: "Authentication successful" }
        else
          render json: {success: false, response: "Authentication failed" }
        end
      else
        set_minimum_password_length
        respond_with resource
      end
    end
  </code></pre>
  
  <p>The problem is that <code>reset_password_by_token</code> is requesting authorization:</p>
  
  <pre><code> app/controllers/users/passwords_controller.rb:33:in `update'
  Completed 401 Unauthorized in 220ms (ActiveRecord: 60.8ms | Allocations: 6810)
  </code></pre>
  
  <p>This seems odd to me as I'd expect the user to be able to log in once with the token (unless expired) for the password change. At that point I'd like to return the jwt (hence using <code>warden.authenticate</code>) so that the front-end application may immediately use it to sign the user in.</p>
  
  <p>Would anyone be able to point me in the correct direction here?</p>