Be sure to halt on failures, closes #856

CHANGELOG.rdoc

@@ -16,6 +16,7 @@
   * Custom failure apps no longer ignored in test mode (by github.com/jaghion)
   * Do not depend on ActiveModel::Dirty
   * Manual sign_in now triggers remember token
+  * Be sure to halt strategies on failures
 
 * deprecations
   * Deprecated anybody_signed_in? in favor of signed_in? (by github.com/gavinhughes)

lib/devise/strategies/authenticatable.rb

@@ -21,6 +21,7 @@ module Devise
         case result
         when String, Symbol
           fail!(result)
+          false
         when TrueClass
           decorate(resource)
           true

lib/devise/strategies/database_authenticatable.rb

@@ -10,7 +10,7 @@ module Devise
         if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid)
         end
       end

lib/devise/strategies/rememberable.rb

@@ -20,7 +20,7 @@ module Devise
 
         if validate(resource)
           success!(resource)
-        else
+        elsif !halted?
           cookies.delete(remember_key)
           pass
         end

lib/devise/strategies/token_authenticatable.rb

@@ -20,7 +20,7 @@ module Devise
         if validate(resource)
           resource.after_token_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid_token)
         end
       end