Do not force halt on authenticatable. This allows other strategies (like devise_imapable or even devise_facebook_connectable) to hook into sessions controller as well.

Those strategies should follow the same convention, allowing them to be cascated.

lib/devise/strategies/authenticatable.rb

@@ -16,7 +16,7 @@ module Devise
         if resource = mapping.to.authenticate(params[scope])
           success!(resource)
         else
-          fail!(:invalid)
+          fail(:invalid)
         end
       end