Disable HTTP Authentication by default. You can turn it on in the initializer.

CHANGELOG.rdoc

@@ -1,5 +1,6 @@
 * deprecations
   * sign_out_all_scopes defaults to true as security measure
+  * http authenticatable is disabled by default
 
 * enhancements
   * Added OAuth 2 support

lib/devise.rb

@@ -70,9 +70,9 @@ module Devise
 
   # If http authentication is enabled by default.
   mattr_accessor :http_authenticatable
-  @@http_authenticatable = true
+  @@http_authenticatable = false
 
-  # If http authentication is used for ajax requests. True by default.
+  # If http headers should be returned for ajax requests. True by default.
   mattr_accessor :http_authenticatable_on_xhr
   @@http_authenticatable_on_xhr = true
 

lib/devise/failure_app.rb

@@ -27,7 +27,6 @@ module Devise
       elsif warden_options[:recall]
         recall
       else
-        debug!
         redirect
       end
     end
@@ -53,11 +52,6 @@ module Devise
 
   protected
 
-    def debug!
-      return unless Rails.logger.try(:debug?)
-      Rails.logger.debug "[Devise] Could not sign in #{scope}: #{i18n_message.inspect}."
-    end
-
     def i18n_message(default = nil)
       message = warden.message || warden_options[:message] || default || :unauthenticated
 
@@ -74,7 +68,7 @@ module Devise
     end
 
     def http_auth?
-      !Devise.navigational_formats.include?(request.format.to_sym) || (request.xhr? && Devise.http_authenticatable_on_xhr)
+      !Devise.navigational_formats.include?(request.format.to_sym) || (Devise.http_authenticatable_on_xhr && request.xhr?)
     end
 
     def http_auth_body

lib/devise/strategies/authenticatable.rb

@@ -9,7 +9,7 @@ module Devise
       attr_accessor :authentication_hash, :password
 
       def valid?
-        valid_for_http_auth? || valid_for_params_auth?
+        valid_for_params_auth? || valid_for_http_auth?
       end
 
     private

lib/generators/templates/devise.rb

@@ -25,10 +25,10 @@ Devise.setup do |config|
   # Tell if authentication through request.params is enabled. True by default.
   # config.params_authenticatable = true
 
-  # Tell if authentication through HTTP Basic Auth is enabled. True by default.
+  # Tell if authentication through HTTP Basic Auth is enabled. False by default.
   # config.http_authenticatable = true
 
-  # Set this to true to use Basic Auth for AJAX requests.  True by default.
+  # If http headers should be returned for AJAX requests. True by default.
   # config.http_authenticatable_on_xhr = true
 
   # The realm used in Http Basic Authentication

test/rails_app/config/initializers/devise.rb

@@ -26,7 +26,7 @@ Devise.setup do |config|
   # config.params_authenticatable = true
 
   # Tell if authentication through HTTP Basic Auth is enabled. True by default.
-  # config.http_authenticatable = true
+  config.http_authenticatable = true
 
   # The realm used in Http Basic Authentication
   # config.http_authentication_realm = "Application"