title: Can I control when a custom Devise/Warden strategy is run with before filters?
body: <p>I'm developing a web application using Rails 3.2 and am using Devise and Warden for handling authentications. </p>
  
  <p>I wanted to implement a custom authentication method for my app, so I read through Warden Wiki pages (<a href="https://github.com/hassox/warden/wiki" rel="nofollow">https://github.com/hassox/warden/wiki</a>) and created a custom Warden strategy with similar structure as the one showed in its documentation (I'll copy that below for the sake of clarity):</p>
  
  <pre><code>Warden::Strategies.add(:password) do
  
    def valid?
      params['username'] || params['password']
    end
  
    def authenticate!
      u = User.authenticate(params['username'], params['password'])
      u.nil? ? fail!("Could not log in") : success!(u)
    end
  
  end
  </code></pre>
  
  <p>Following that, I added my custom "password" strategy to Devise appending the following code in <strong>config/initializers/devise.rb</strong></p>
  
  <pre><code>config.warden do |manager|
      manager.default_strategies(:scope =&gt; :user).unshift :password
  end
  </code></pre>
  
  <p>The problem I've found is that this authentication strategy is executed on every request, and I wanted to provide free access to certain requests to specific routes in my application. Initially, I thought of preventing the execution of the strategy using</p>
  
  <pre><code>skip_before_filter :authenticate_user!
  </code></pre>
  
  <p>on every controller whose actions doesn't require authentication, but the authentication keeps on executing even requesting to those controllers.</p>
  
  <p>Can anybody help me how to skip the authentication in some requests? Or even more important, is my idea useless to achieve what I want?</p>
  
  <p>Thanks in advance for your help. I really appreciate it.</p>
  
  <p><strong>Update</strong></p>
  
  <p>While debugging my code looking for a solution, I commented out all <em>before_filter</em> statements in all controller's code and discovered that the authentication strategy still executes. This behaviour turns out to be really strange to me. Does this make sense to anybody?</p>