From 2024fca4dfa3323070c3477e262b8422cadf6a42 Mon Sep 17 00:00:00 2001
From: Thomas Walpole <twalpole@gmail.com>
Date: Tue, 18 Aug 2015 16:42:56 -0700
Subject: [PATCH] Rails 5 compatability. Remove rails < 4.1 and Ruby < 2.1

---
 .travis.yml                                   |  14 +-
 Gemfile.lock                                  |  45 ++--
 README.md                                     |   2 +-
 .../devise/omniauth_callbacks_controller.rb   |   8 +-
 .../devise/passwords_controller.rb            |   4 +-
 .../devise/registrations_controller.rb        |   4 +-
 app/controllers/devise/sessions_controller.rb |   8 +-
 app/controllers/devise/unlocks_controller.rb  |   2 +-
 app/controllers/devise_controller.rb          |   6 +-
 devise.gemspec                                |   4 +-
 gemfiles/Gemfile.rails-3.2-stable             |  29 ---
 gemfiles/Gemfile.rails-3.2-stable.lock        | 172 -------------
 gemfiles/Gemfile.rails-4.0-stable             |  29 ---
 gemfiles/Gemfile.rails-4.0-stable.lock        | 166 ------------
 gemfiles/Gemfile.rails-4.1-stable.lock        | 100 ++++----
 gemfiles/Gemfile.rails-4.2-stable.lock        |  99 ++++----
 gemfiles/Gemfile.rails-5.0-alpha              |  41 +++
 gemfiles/Gemfile.rails-5.0-alpha.lock         | 236 ++++++++++++++++++
 lib/devise/controllers/helpers.rb             |  12 +-
 lib/devise/failure_app.rb                     |  26 +-
 lib/devise/models/authenticatable.rb          |   1 +
 lib/devise/models/confirmable.rb              |   1 +
 lib/devise/models/database_authenticatable.rb |   1 +
 lib/devise/rails/routes.rb                    |  39 +--
 lib/devise/test_helpers.rb                    |  13 +-
 .../active_record/devise_generator.rb         |   6 +-
 lib/generators/devise/orm_helpers.rb          |  17 --
 .../controllers/registrations_controller.rb   |   4 +-
 .../controllers/sessions_controller.rb        |   2 +-
 lib/generators/templates/devise.rb            |   4 -
 .../custom_registrations_controller_test.rb   |  10 +-
 test/controllers/custom_strategy_test.rb      |  12 +-
 test/controllers/helper_methods_test.rb       |   2 +-
 test/controllers/helpers_test.rb              |   2 +-
 ...inherited_controller_i18n_messages_test.rb |   4 +-
 test/controllers/internal_helpers_test.rb     |  19 +-
 .../controllers/load_hooks_controller_test.rb |   2 +-
 test/controllers/passwords_controller_test.rb |   7 +-
 test/controllers/sessions_controller_test.rb  |  39 +--
 test/controllers/url_helpers_test.rb          |   2 +-
 test/failure_app_test.rb                      |  33 +--
 .../active_record_generator_test.rb           |  26 --
 test/helpers/devise_helper_test.rb            |   2 +-
 test/integration/authenticatable_test.rb      |  48 ++--
 test/integration/confirmable_test.rb          |  10 +-
 .../database_authenticatable_test.rb          |   2 +-
 test/integration/http_authenticatable_test.rb |   9 +-
 test/integration/lockable_test.rb             |   7 +-
 test/integration/omniauthable_test.rb         |   2 +-
 test/integration/recoverable_test.rb          |  20 +-
 test/integration/registerable_test.rb         |  20 +-
 test/integration/rememberable_test.rb         |  10 +-
 test/integration/timeoutable_test.rb          |   8 +-
 test/integration/trackable_test.rb            |   2 +-
 test/models/validatable_test.rb               |  12 +-
 test/omniauth/url_helpers_test.rb             |   3 +-
 test/orm/active_record.rb                     |   7 +-
 test/parameter_sanitizer_test.rb              |  28 ++-
 test/rails_app/app/active_record/user.rb      |   3 +
 .../app/controllers/admins_controller.rb      |   2 +-
 .../app/controllers/application_controller.rb |   4 +-
 .../app/controllers/home_controller.rb        |   6 +-
 .../users/omniauth_callbacks_controller.rb    |   4 +-
 .../app/controllers/users_controller.rb       |  10 +-
 test/rails_app/config/application.rb          |   2 +-
 test/rails_app/config/boot.rb                 |   6 +-
 test/rails_app/config/environments/test.rb    |   7 +-
 .../config/initializers/secret_token.rb       |   7 +-
 test/routes_test.rb                           |  37 ++-
 test/support/http_method_compatibility.rb     |  51 ++++
 test/support/webrat/integrations/rails.rb     |   9 +
 test/test_helpers_test.rb                     |   6 +-
 72 files changed, 782 insertions(+), 815 deletions(-)
 delete mode 100644 gemfiles/Gemfile.rails-3.2-stable
 delete mode 100644 gemfiles/Gemfile.rails-3.2-stable.lock
 delete mode 100644 gemfiles/Gemfile.rails-4.0-stable
 delete mode 100644 gemfiles/Gemfile.rails-4.0-stable.lock
 create mode 100644 gemfiles/Gemfile.rails-5.0-alpha
 create mode 100644 gemfiles/Gemfile.rails-5.0-alpha.lock
 create mode 100644 test/support/http_method_compatibility.rb

diff --git a/.travis.yml b/.travis.yml
index 43bc8a4c..bf817434 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,23 +1,21 @@
 language: ruby
 
 rvm:
-  - 1.9.3
-  - 2.0.0
   - 2.1
   - 2.2
 
 gemfile:
   - gemfiles/Gemfile.rails-4.2-stable
   - gemfiles/Gemfile.rails-4.1-stable
-  - gemfiles/Gemfile.rails-4.0-stable
-  - gemfiles/Gemfile.rails-3.2-stable
   - Gemfile
 
 matrix:
-  exclude:
-    - rvm: 2.2
-      gemfile: gemfiles/Gemfile.rails-3.2-stable
-
+  include:
+    - rvm: 2.2.2
+      gemfile: gemfiles/Gemfile.rails-5.0-alpha
+  allow_failures:
+    - rvm: 2.2.2
+      gemfile: gemfiles/Gemfile.rails-5.0-alpha
 services:
   - mongodb
 
diff --git a/Gemfile.lock b/Gemfile.lock
index fc60013f..b86b761f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -4,7 +4,7 @@ PATH
     devise (3.5.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0, < 5)
       responders
       thread_safe (~> 0.1)
       warden (~> 1.2.3)
@@ -47,28 +47,29 @@ GEM
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    arel (6.0.0)
+    arel (6.0.3)
     bcrypt (3.1.10)
-    bson (3.1.2)
+    bson (3.2.6)
     builder (3.2.2)
+    concurrent-ruby (1.0.0)
     connection_pool (2.2.0)
     erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
-    globalid (0.3.5)
+    globalid (0.3.6)
       activesupport (>= 4.1.0)
-    hashie (3.4.0)
+    hashie (3.4.3)
     i18n (0.7.0)
     json (1.8.3)
-    jwt (1.4.1)
-    loofah (2.0.2)
+    jwt (1.5.2)
+    loofah (2.0.3)
       nokogiri (>= 1.5.9)
     mail (2.6.3)
       mime-types (>= 1.16, < 3)
     metaclass (0.0.4)
-    mime-types (2.6.1)
-    mini_portile (0.6.2)
-    minitest (5.7.0)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.3)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mongoid (4.0.2)
@@ -76,15 +77,15 @@ GEM
       moped (~> 2.0.0)
       origin (~> 2.1)
       tzinfo (>= 0.3.37)
-    moped (2.0.6)
+    moped (2.0.7)
       bson (~> 3.0)
       connection_pool (~> 2.0)
       optionable (~> 0.2.0)
-    multi_json (1.11.1)
+    multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7)
+      mini_portile2 (~> 2.0.0.rc2)
     oauth2 (0.9.4)
       faraday (>= 0.8, < 0.10)
       jwt (~> 1.0)
@@ -107,7 +108,7 @@ GEM
     optionable (0.2.0)
     origin (2.1.1)
     orm_adapter (0.5.0)
-    rack (1.6.2)
+    rack (1.6.4)
     rack-openid (1.3.1)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
@@ -126,7 +127,7 @@ GEM
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
       activesupport (>= 4.2.0.beta, < 5.0)
       nokogiri (~> 1.6.0)
       rails-deprecated_sanitizer (>= 1.0.1)
@@ -139,16 +140,18 @@ GEM
       thor (>= 0.18.1, < 2.0)
     rake (10.4.2)
     rdoc (4.2.0)
+      json (~> 1.4)
     responders (2.1.0)
       railties (>= 4.2.0, < 5)
     ruby-openid (2.7.0)
-    sprockets (3.2.0)
-      rack (~> 1.0)
-    sprockets-rails (2.3.1)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (2.3.3)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sqlite3 (1.3.11)
     thor (0.19.1)
     thread_safe (0.3.5)
     tzinfo (1.2.2)
diff --git a/README.md b/README.md
index ec3b6fa2..ba86d7ed 100644
--- a/README.md
+++ b/README.md
@@ -477,7 +477,7 @@ devise :database_authenticatable, :timeoutable
 devise_for :admins
 
 # Inside your protected controller
-before_filter :authenticate_admin!
+before_action :authenticate_admin!
 
 # Inside your controllers and views
 admin_signed_in?
diff --git a/app/controllers/devise/omniauth_callbacks_controller.rb b/app/controllers/devise/omniauth_callbacks_controller.rb
index 38c6857e..d04a57a4 100644
--- a/app/controllers/devise/omniauth_callbacks_controller.rb
+++ b/app/controllers/devise/omniauth_callbacks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::OmniauthCallbacksController < DeviseController
-  prepend_before_filter { request.env["devise.skip_timeout"] = true }
+  prepend_before_action { request.env["devise.skip_timeout"] = true }
 
   def passthru
     render status: 404, text: "Not found. Authentication passthru."
@@ -13,14 +13,14 @@ class Devise::OmniauthCallbacksController < DeviseController
   protected
 
   def failed_strategy
-    env["omniauth.error.strategy"]
+    request.respond_to?(:get_header) ? request.get_header("omniauth.error.strategy") : env["omniauth.error.strategy"]
   end
 
   def failure_message
-    exception = env["omniauth.error"]
+    exception = request.respond_to?(:get_header) ? request.get_header("omniauth.error") : env["omniauth.error"]
     error   = exception.error_reason if exception.respond_to?(:error_reason)
     error ||= exception.error        if exception.respond_to?(:error)
-    error ||= env["omniauth.error.type"].to_s
+    error ||= (request.respond_to?(:get_header) ? request.get_header("omniauth.error.type") : env["omniauth.error.type"]).to_s
     error.to_s.humanize if error
   end
 
diff --git a/app/controllers/devise/passwords_controller.rb b/app/controllers/devise/passwords_controller.rb
index 1906b84c..851634ad 100644
--- a/app/controllers/devise/passwords_controller.rb
+++ b/app/controllers/devise/passwords_controller.rb
@@ -1,7 +1,7 @@
 class Devise::PasswordsController < DeviseController
-  prepend_before_filter :require_no_authentication
+  prepend_before_action :require_no_authentication
   # Render the #edit only if coming from a reset password email link
-  append_before_filter :assert_reset_token_passed, only: :edit
+  append_before_action :assert_reset_token_passed, only: :edit
 
   # GET /resource/password/new
   def new
diff --git a/app/controllers/devise/registrations_controller.rb b/app/controllers/devise/registrations_controller.rb
index 36dcd825..27c1a596 100644
--- a/app/controllers/devise/registrations_controller.rb
+++ b/app/controllers/devise/registrations_controller.rb
@@ -1,6 +1,6 @@
 class Devise::RegistrationsController < DeviseController
-  prepend_before_filter :require_no_authentication, only: [:new, :create, :cancel]
-  prepend_before_filter :authenticate_scope!, only: [:edit, :update, :destroy]
+  prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
+  prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]
 
   # GET /resource/sign_up
   def new
diff --git a/app/controllers/devise/sessions_controller.rb b/app/controllers/devise/sessions_controller.rb
index d8d18d78..4adf377d 100644
--- a/app/controllers/devise/sessions_controller.rb
+++ b/app/controllers/devise/sessions_controller.rb
@@ -1,8 +1,8 @@
 class Devise::SessionsController < DeviseController
-  prepend_before_filter :require_no_authentication, only: [:new, :create]
-  prepend_before_filter :allow_params_authentication!, only: :create
-  prepend_before_filter :verify_signed_out_user, only: :destroy
-  prepend_before_filter only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }
+  prepend_before_action :require_no_authentication, only: [:new, :create]
+  prepend_before_action :allow_params_authentication!, only: :create
+  prepend_before_action :verify_signed_out_user, only: :destroy
+  prepend_before_action only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }
 
   # GET /resource/sign_in
   def new
diff --git a/app/controllers/devise/unlocks_controller.rb b/app/controllers/devise/unlocks_controller.rb
index bcc2b16b..8bbbfe01 100644
--- a/app/controllers/devise/unlocks_controller.rb
+++ b/app/controllers/devise/unlocks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::UnlocksController < DeviseController
-  prepend_before_filter :require_no_authentication
+  prepend_before_action :require_no_authentication
 
   # GET /resource/unlock/new
   def new
diff --git a/app/controllers/devise_controller.rb b/app/controllers/devise_controller.rb
index bb3feafa..3d7cd222 100644
--- a/app/controllers/devise_controller.rb
+++ b/app/controllers/devise_controller.rb
@@ -8,7 +8,7 @@ class DeviseController < Devise.parent_controller.constantize
                resource_class resource_params devise_mapping)
   helper_method(*helpers)
 
-  prepend_before_filter :assert_is_devise_resource!
+  prepend_before_action :assert_is_devise_resource!
   respond_to :html if mimes_for_respond_to.empty?
 
   # Override prefixes to consider the scoped view.
@@ -89,10 +89,10 @@ MESSAGE
     instance_variable_set(:"@#{resource_name}", new_resource)
   end
 
-  # Helper for use in before_filters where no authentication is required.
+  # Helper for use in before_actions where no authentication is required.
   #
   # Example:
-  #   before_filter :require_no_authentication, only: :new
+  #   before_action :require_no_authentication, only: :new
   def require_no_authentication
     assert_is_devise_resource!
     return unless is_navigational_format?
diff --git a/devise.gemspec b/devise.gemspec
index 16f754c1..491832eb 100644
--- a/devise.gemspec
+++ b/devise.gemspec
@@ -16,12 +16,12 @@ Gem::Specification.new do |s|
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- test/*`.split("\n")
   s.require_paths = ["lib"]
-  s.required_ruby_version = '>= 1.9.3'
+  s.required_ruby_version = '>= 2.1.0'
 
   s.add_dependency("warden", "~> 1.2.3")
   s.add_dependency("orm_adapter", "~> 0.1")
   s.add_dependency("bcrypt", "~> 3.0")
   s.add_dependency("thread_safe", "~> 0.1")
-  s.add_dependency("railties", ">= 3.2.6", "< 5")
+  s.add_dependency("railties", ">= 4.1.0", "< 5")
   s.add_dependency("responders")
 end
diff --git a/gemfiles/Gemfile.rails-3.2-stable b/gemfiles/Gemfile.rails-3.2-stable
deleted file mode 100644
index 99713e0d..00000000
--- a/gemfiles/Gemfile.rails-3.2-stable
+++ /dev/null
@@ -1,29 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: '..'
-
-gem "rails", github: 'rails/rails', branch: '3-2-stable'
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
-gem "rdoc"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-end
-
-platforms :jruby do
-  gem "activerecord-jdbc-adapter"
-  gem "activerecord-jdbcsqlite3-adapter"
-  gem "jruby-openssl"
-end
-
-platforms :ruby do
-  gem "sqlite3"
-end
-
-group :mongoid do
-  gem "mongoid", "~> 3.0"
-end
diff --git a/gemfiles/Gemfile.rails-3.2-stable.lock b/gemfiles/Gemfile.rails-3.2-stable.lock
deleted file mode 100644
index f33db3a7..00000000
--- a/gemfiles/Gemfile.rails-3.2-stable.lock
+++ /dev/null
@@ -1,172 +0,0 @@
-GIT
-  remote: git://github.com/rails/rails.git
-  revision: b344986bc3d94ca7821fc5e0eef1874882ac6cbb
-  branch: 3-2-stable
-  specs:
-    actionmailer (3.2.21)
-      actionpack (= 3.2.21)
-      mail (~> 2.5.4)
-    actionpack (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-      builder (~> 3.0.0)
-      erubis (~> 2.7.0)
-      journey (~> 1.0.4)
-      rack (~> 1.4.5)
-      rack-cache (~> 1.2)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.2.1)
-    activemodel (3.2.21)
-      activesupport (= 3.2.21)
-      builder (~> 3.0.0)
-    activerecord (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-      arel (~> 3.0.2)
-      tzinfo (~> 0.3.29)
-    activeresource (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-    activesupport (3.2.21)
-      i18n (~> 0.6, >= 0.6.4)
-      multi_json (~> 1.0)
-    rails (3.2.21)
-      actionmailer (= 3.2.21)
-      actionpack (= 3.2.21)
-      activerecord (= 3.2.21)
-      activeresource (= 3.2.21)
-      activesupport (= 3.2.21)
-      bundler (~> 1.0)
-      railties (= 3.2.21)
-    railties (3.2.21)
-      actionpack (= 3.2.21)
-      activesupport (= 3.2.21)
-      rack-ssl (~> 1.3.2)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (>= 0.14.6, < 2.0)
-
-PATH
-  remote: ..
-  specs:
-    devise (3.5.3)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
-      responders
-      thread_safe (~> 0.1)
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    arel (3.0.3)
-    bcrypt (3.1.10)
-    builder (3.0.4)
-    erubis (2.7.0)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
-    i18n (0.7.0)
-    journey (1.0.4)
-    json (1.8.2)
-    jwt (1.4.1)
-    mail (2.5.4)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    metaclass (0.0.4)
-    mime-types (1.25.1)
-    mini_portile (0.6.2)
-    mocha (1.1.0)
-      metaclass (~> 0.0.1)
-    mongoid (3.1.6)
-      activemodel (~> 3.2)
-      moped (~> 1.4)
-      origin (~> 1.0)
-      tzinfo (~> 0.3.29)
-    moped (1.5.2)
-    multi_json (1.11.0)
-    multi_xml (0.5.5)
-    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    oauth2 (0.9.4)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
-      hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    origin (1.1.0)
-    orm_adapter (0.5.0)
-    polyglot (0.3.5)
-    rack (1.4.5)
-    rack-cache (1.2)
-      rack (>= 0.4)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-ssl (1.3.4)
-      rack
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (3.12.2)
-      json (~> 1.4)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
-    ruby-openid (2.7.0)
-    sprockets (2.2.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sqlite3 (1.3.10)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (1.4.1)
-    treetop (1.4.15)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.43)
-    warden (1.2.4)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  devise!
-  jruby-openssl
-  mocha (~> 1.1)
-  mongoid (~> 3.0)
-  omniauth (~> 1.2.0)
-  omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
-  rails!
-  rdoc
-  sqlite3
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.10.6
diff --git a/gemfiles/Gemfile.rails-4.0-stable b/gemfiles/Gemfile.rails-4.0-stable
deleted file mode 100644
index 66ab20d3..00000000
--- a/gemfiles/Gemfile.rails-4.0-stable
+++ /dev/null
@@ -1,29 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: '..'
-
-gem "rails", github: 'rails/rails', branch: '4-0-stable'
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
-gem "rdoc"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-end
-
-platforms :jruby do
-  gem "activerecord-jdbc-adapter"
-  gem "activerecord-jdbcsqlite3-adapter"
-  gem "jruby-openssl"
-end
-
-platforms :ruby do
-  gem "sqlite3"
-end
-
-group :mongoid do
-  gem "mongoid", "~> 4.0.0"
-end
diff --git a/gemfiles/Gemfile.rails-4.0-stable.lock b/gemfiles/Gemfile.rails-4.0-stable.lock
deleted file mode 100644
index ab3bd528..00000000
--- a/gemfiles/Gemfile.rails-4.0-stable.lock
+++ /dev/null
@@ -1,166 +0,0 @@
-GIT
-  remote: git://github.com/rails/rails.git
-  revision: 7ec9c9635bf4d57009135ed11e89d8bf32306d73
-  branch: 4-0-stable
-  specs:
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
-      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
-      rack-test (~> 0.6.2)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-
-PATH
-  remote: ..
-  specs:
-    devise (3.5.3)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
-      responders
-      thread_safe (~> 0.1)
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activerecord-deprecated_finders (1.0.3)
-    arel (4.0.2)
-    bcrypt (3.1.10)
-    bson (2.3.0)
-    builder (3.1.4)
-    connection_pool (2.1.3)
-    erubis (2.7.0)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
-    i18n (0.7.0)
-    jwt (1.4.1)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
-    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (4.7.5)
-    mocha (1.1.0)
-      metaclass (~> 0.0.1)
-    mongoid (4.0.2)
-      activemodel (~> 4.0)
-      moped (~> 2.0.0)
-      origin (~> 2.1)
-      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
-      connection_pool (~> 2.0)
-      optionable (~> 0.2.0)
-    multi_json (1.11.0)
-    multi_xml (0.5.5)
-    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    oauth2 (0.9.4)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
-      hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    optionable (0.2.0)
-    origin (2.1.1)
-    orm_adapter (0.5.0)
-    rack (1.5.2)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
-    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (1.4.1)
-    tzinfo (0.3.43)
-    warden (1.2.4)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  devise!
-  jruby-openssl
-  mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.2.0)
-  omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
-  rails!
-  rdoc
-  sqlite3
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.10.6
diff --git a/gemfiles/Gemfile.rails-4.1-stable.lock b/gemfiles/Gemfile.rails-4.1-stable.lock
index 35d917d9..d4052c24 100644
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -1,47 +1,47 @@
 GIT
   remote: git://github.com/rails/rails.git
-  revision: bf32ec7b8611e6b4c7e9398f7d297a1f0221e9b9
+  revision: 7310a6d5c82d990122f5c49114aeb93dfa73b031
   branch: 4-1-stable
   specs:
-    actionmailer (4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
+    actionmailer (4.1.14)
+      actionpack (= 4.1.14)
+      actionview (= 4.1.14)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.10)
-      actionview (= 4.1.10)
-      activesupport (= 4.1.10)
+    actionpack (4.1.14)
+      actionview (= 4.1.14)
+      activesupport (= 4.1.14)
       rack (~> 1.5.2)
       rack-test (~> 0.6.2)
-    actionview (4.1.10)
-      activesupport (= 4.1.10)
+    actionview (4.1.14)
+      activesupport (= 4.1.14)
       builder (~> 3.1)
       erubis (~> 2.7.0)
-    activemodel (4.1.10)
-      activesupport (= 4.1.10)
+    activemodel (4.1.14)
+      activesupport (= 4.1.14)
       builder (~> 3.1)
-    activerecord (4.1.10)
-      activemodel (= 4.1.10)
-      activesupport (= 4.1.10)
+    activerecord (4.1.14)
+      activemodel (= 4.1.14)
+      activesupport (= 4.1.14)
       arel (~> 5.0.0)
-    activesupport (4.1.10)
+    activesupport (4.1.14)
       i18n (~> 0.6, >= 0.6.9)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.1)
       tzinfo (~> 1.1)
-    rails (4.1.10)
-      actionmailer (= 4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
-      activemodel (= 4.1.10)
-      activerecord (= 4.1.10)
-      activesupport (= 4.1.10)
+    rails (4.1.14)
+      actionmailer (= 4.1.14)
+      actionpack (= 4.1.14)
+      actionview (= 4.1.14)
+      activemodel (= 4.1.14)
+      activerecord (= 4.1.14)
+      activesupport (= 4.1.14)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.10)
+      railties (= 4.1.14)
       sprockets-rails (~> 2.0)
-    railties (4.1.10)
-      actionpack (= 4.1.10)
-      activesupport (= 4.1.10)
+    railties (4.1.14)
+      actionpack (= 4.1.14)
+      activesupport (= 4.1.14)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
 
@@ -51,7 +51,7 @@ PATH
     devise (3.5.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0, < 5)
       responders
       thread_safe (~> 0.1)
       warden (~> 1.2.3)
@@ -61,23 +61,23 @@ GEM
   specs:
     arel (5.0.1.20140414130214)
     bcrypt (3.1.10)
-    bson (2.3.0)
+    bson (3.2.6)
     builder (3.2.2)
-    connection_pool (2.1.3)
+    concurrent-ruby (1.0.0)
+    connection_pool (2.2.0)
     erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.3)
     i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
+    json (1.8.3)
+    jwt (1.5.2)
     mail (2.6.3)
       mime-types (>= 1.16, < 3)
     metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (5.5.1)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.3)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mongoid (4.0.2)
@@ -85,15 +85,15 @@ GEM
       moped (~> 2.0.0)
       origin (~> 2.1)
       tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
       connection_pool (~> 2.0)
       optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7)
+      mini_portile2 (~> 2.0.0.rc2)
     oauth2 (0.9.4)
       faraday (>= 0.8, < 0.10)
       jwt (~> 1.0)
@@ -116,7 +116,7 @@ GEM
     optionable (0.2.0)
     origin (2.1.1)
     orm_adapter (0.5.0)
-    rack (1.5.2)
+    rack (1.5.5)
     rack-openid (1.3.1)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
@@ -124,22 +124,20 @@ GEM
       rack (>= 1.0)
     rake (10.4.2)
     rdoc (4.2.0)
+      json (~> 1.4)
     responders (1.1.2)
       railties (>= 3.2, < 4.2)
     ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (2.3.3)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sqlite3 (1.3.11)
     thor (0.19.1)
     thread_safe (0.3.5)
-    tilt (1.4.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
     warden (1.2.4)
diff --git a/gemfiles/Gemfile.rails-4.2-stable.lock b/gemfiles/Gemfile.rails-4.2-stable.lock
index 678baf49..e9b8b0d5 100644
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,57 +1,57 @@
 GIT
   remote: git://github.com/rails/rails.git
-  revision: f12ff8ddab7b199707ec36d72bd72f206f142c8b
+  revision: f2b860fc0846c89e0cb2f5d844af458c410c65e3
   branch: 4-2-stable
   specs:
-    actionmailer (4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
+    actionmailer (4.2.4)
+      actionpack (= 4.2.4)
+      actionview (= 4.2.4)
+      activejob (= 4.2.4)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.1)
-      actionview (= 4.2.1)
-      activesupport (= 4.2.1)
+    actionpack (4.2.4)
+      actionview (= 4.2.4)
+      activesupport (= 4.2.4)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.1)
-      activesupport (= 4.2.1)
+    actionview (4.2.4)
+      activesupport (= 4.2.4)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.1)
-      activesupport (= 4.2.1)
+    activejob (4.2.4)
+      activesupport (= 4.2.4)
       globalid (>= 0.3.0)
-    activemodel (4.2.1)
-      activesupport (= 4.2.1)
+    activemodel (4.2.4)
+      activesupport (= 4.2.4)
       builder (~> 3.1)
-    activerecord (4.2.1)
-      activemodel (= 4.2.1)
-      activesupport (= 4.2.1)
+    activerecord (4.2.4)
+      activemodel (= 4.2.4)
+      activesupport (= 4.2.4)
       arel (~> 6.0)
-    activesupport (4.2.1)
+    activesupport (4.2.4)
       i18n (~> 0.7)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    rails (4.2.1)
-      actionmailer (= 4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
-      activemodel (= 4.2.1)
-      activerecord (= 4.2.1)
-      activesupport (= 4.2.1)
+    rails (4.2.4)
+      actionmailer (= 4.2.4)
+      actionpack (= 4.2.4)
+      actionview (= 4.2.4)
+      activejob (= 4.2.4)
+      activemodel (= 4.2.4)
+      activerecord (= 4.2.4)
+      activesupport (= 4.2.4)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.1)
+      railties (= 4.2.4)
       sprockets-rails
-    railties (4.2.1)
-      actionpack (= 4.2.1)
-      activesupport (= 4.2.1)
+    railties (4.2.4)
+      actionpack (= 4.2.4)
+      activesupport (= 4.2.4)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
 
@@ -69,29 +69,28 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    arel (6.0.0)
+    arel (6.0.3)
     bcrypt (3.1.10)
-    bson (2.3.0)
+    bson (3.2.1)
     builder (3.2.2)
-    connection_pool (2.1.3)
+    connection_pool (2.2.0)
     erubis (2.7.0)
     faraday (0.9.1)
       multipart-post (>= 1.2, < 3)
-    globalid (0.3.3)
+    globalid (0.3.6)
       activesupport (>= 4.1.0)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.2)
     i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
-    loofah (2.0.1)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
       nokogiri (>= 1.5.9)
     mail (2.6.3)
       mime-types (>= 1.16, < 3)
     metaclass (0.0.4)
-    mime-types (2.4.3)
+    mime-types (2.6.1)
     mini_portile (0.6.2)
-    minitest (5.5.1)
+    minitest (5.8.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mongoid (4.0.2)
@@ -99,11 +98,11 @@ GEM
       moped (~> 2.0.0)
       origin (~> 2.1)
       tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
       connection_pool (~> 2.0)
       optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
     nokogiri (1.6.6.2)
@@ -130,7 +129,7 @@ GEM
     optionable (0.2.0)
     origin (2.1.1)
     orm_adapter (0.5.0)
-    rack (1.6.0)
+    rack (1.6.4)
     rack-openid (1.3.1)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
@@ -138,7 +137,7 @@ GEM
       rack (>= 1.0)
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
       activesupport (>= 4.2.0.beta, < 5.0)
       nokogiri (~> 1.6.0)
       rails-deprecated_sanitizer (>= 1.0.1)
@@ -149,19 +148,15 @@ GEM
     responders (2.1.0)
       railties (>= 4.2.0, < 5)
     ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
+    sprockets (3.3.3)
       rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
+    sprockets-rails (2.3.2)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
     sqlite3 (1.3.10)
     thor (0.19.1)
     thread_safe (0.3.5)
-    tilt (1.4.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
     warden (1.2.4)
diff --git a/gemfiles/Gemfile.rails-5.0-alpha b/gemfiles/Gemfile.rails-5.0-alpha
new file mode 100644
index 00000000..10e60858
--- /dev/null
+++ b/gemfiles/Gemfile.rails-5.0-alpha
@@ -0,0 +1,41 @@
+source "https://rubygems.org"
+
+gemspec path: '..'
+
+gem "rails", github: 'rails/rails', branch: 'master'
+gem "arel", github: 'rails/arel'
+gem "rack", github: 'rack/rack'
+gem "sprockets-rails", github: 'rails/sprockets-rails'
+gem "sprockets", github: 'rails/sprockets'
+# gem "omniauth", "~> 1.2.2"
+gem "omniauth", github: 'twalpole/omniauth', branch: 'rack_master'
+gem "oauth2", github: 'twalpole/oauth2', branch: 'rack_master'
+gem "omniauth-oauth2", "~> 1.2.0"
+gem "rdoc"
+
+gem 'activemodel-serializers-xml', github: 'rails/activemodel-serializers-xml'
+
+gem 'rails-controller-testing'
+
+gem 'responders', github: 'plataformatec/responders'
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
+  gem "webrat", "0.7.3", require: false
+  gem "mocha", "~> 1.1", require: false
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3"
+end
+
+# group :mongoid do
+#   gem "mongoid", "~> 4.0.0"
+# end
diff --git a/gemfiles/Gemfile.rails-5.0-alpha.lock b/gemfiles/Gemfile.rails-5.0-alpha.lock
new file mode 100644
index 00000000..a12faf79
--- /dev/null
+++ b/gemfiles/Gemfile.rails-5.0-alpha.lock
@@ -0,0 +1,236 @@
+GIT
+  remote: git://github.com/plataformatec/responders.git
+  revision: 240314b4502aa8e84020beee903be80f93b1f109
+  specs:
+    responders (2.1.0)
+      railties (>= 4.2.0, < 5)
+
+GIT
+  remote: git://github.com/rack/rack.git
+  revision: 35599cfc2751e0ee611c0ff799924b8e7fe0c0b4
+  specs:
+    rack (2.0.0.alpha)
+      json
+
+GIT
+  remote: git://github.com/rails/activemodel-serializers-xml.git
+  revision: 1f72d9507c91b1cda10d1d20eac2b74dd6d9d4b9
+  specs:
+    activemodel-serializers-xml (0.1.0)
+      activemodel
+      activerecord
+      activesupport
+
+GIT
+  remote: git://github.com/rails/arel.git
+  revision: 3c429c5d86e9e2201c2a35d934ca6a8911c18e69
+  specs:
+    arel (7.0.0.alpha)
+
+GIT
+  remote: git://github.com/rails/rails.git
+  revision: b859d97081c688f627eda30fc1c601e4ec070205
+  branch: master
+  specs:
+    actionmailer (5.0.0.alpha)
+      actionpack (= 5.0.0.alpha)
+      actionview (= 5.0.0.alpha)
+      activejob (= 5.0.0.alpha)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (5.0.0.alpha)
+      actionview (= 5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      rack (~> 2.x)
+      rack-test (~> 0.6.3)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      globalid (>= 0.3.0)
+    activemodel (5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      builder (~> 3.1)
+    activerecord (5.0.0.alpha)
+      activemodel (= 5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      arel (= 7.0.0.alpha)
+    activesupport (5.0.0.alpha)
+      concurrent-ruby (~> 1.0.0.pre3, < 2.0.0)
+      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
+      method_source
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    rails (5.0.0.alpha)
+      actionmailer (= 5.0.0.alpha)
+      actionpack (= 5.0.0.alpha)
+      actionview (= 5.0.0.alpha)
+      activejob (= 5.0.0.alpha)
+      activemodel (= 5.0.0.alpha)
+      activerecord (= 5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 5.0.0.alpha)
+      sprockets-rails (>= 2.0.0)
+    railties (5.0.0.alpha)
+      actionpack (= 5.0.0.alpha)
+      activesupport (= 5.0.0.alpha)
+      method_source
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+
+GIT
+  remote: git://github.com/rails/sprockets-rails.git
+  revision: 93a45b1c463a063ec7cf4d160107b67aa3db7a1a
+  specs:
+    sprockets-rails (3.0.0.beta3)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+
+GIT
+  remote: git://github.com/rails/sprockets.git
+  revision: 5a77f8b007b8ec61edd783c48baf9d971f1c684d
+  specs:
+    sprockets (4.0.0)
+      rack (>= 1, < 3)
+
+GIT
+  remote: git://github.com/twalpole/oauth2.git
+  revision: 38e5b4bfe29b7ef87e87a3f323a088914393cfb5
+  branch: rack_master
+  specs:
+    oauth2 (1.0.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 2.0)
+
+GIT
+  remote: git://github.com/twalpole/omniauth.git
+  revision: e0c2cd7c75ba741bcbb7318e104ec868454d7cc9
+  branch: rack_master
+  specs:
+    omniauth (1.2.2)
+      hashie (>= 1.2, < 4)
+      rack (>= 1.0, < 2.0)
+
+PATH
+  remote: ..
+  specs:
+    devise (3.5.2)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 3.2.6, < 5)
+      responders
+      thread_safe (~> 0.1)
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bcrypt (3.1.10)
+    builder (3.2.2)
+    concurrent-ruby (1.0.0.pre4)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
+    hashie (3.4.2)
+    i18n (0.7.0)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (2.6.2)
+    mini_portile (0.6.2)
+    minitest (5.8.1)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    multi_json (1.11.2)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.6.2)
+      mini_portile (~> 0.6.0)
+    omniauth-facebook (2.0.1)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.2.0)
+      faraday (>= 0.8, < 0.10)
+      multi_json (~> 1.3)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.5.0)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rails-controller-testing (0.0.3)
+      rails (>= 4.2)
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.2)
+      loofah (~> 2.0)
+    rake (10.4.2)
+    rdoc (4.2.0)
+    ruby-openid (2.7.0)
+    sqlite3 (1.3.11)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    warden (1.2.3)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activemodel-serializers-xml!
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  arel!
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  oauth2!
+  omniauth!
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.2.0)
+  omniauth-openid (~> 1.0.1)
+  rack!
+  rails!
+  rails-controller-testing
+  rdoc
+  responders!
+  sprockets!
+  sprockets-rails!
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.10.6
diff --git a/lib/devise/controllers/helpers.rb b/lib/devise/controllers/helpers.rb
index 58e894db..2516b8cb 100644
--- a/lib/devise/controllers/helpers.rb
+++ b/lib/devise/controllers/helpers.rb
@@ -30,8 +30,8 @@ module Devise
         #     current_bloggers       # Currently signed in user and admin
         #
         #   Use:
-        #     before_filter :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
-        #     before_filter ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
+        #     before_action :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
+        #     before_action ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
         #     current_blogger :user                             # Preferably returns a User if one is signed in
         #
         def devise_group(group_name, opts={})
@@ -84,7 +84,7 @@ module Devise
       end
 
       # Define authentication filters and accessor helpers based on mappings.
-      # These filters should be used inside the controllers as before_filters,
+      # These filters should be used inside the controllers as before_actions,
       # so you can control the scope of the user who should be signed in to
       # access that specific controller/action.
       # Example:
@@ -104,8 +104,8 @@ module Devise
       #     admin_session       # Session data available only to the admin scope
       #
       #   Use:
-      #     before_filter :authenticate_user!  # Tell devise to use :user map
-      #     before_filter :authenticate_admin! # Tell devise to use :admin map
+      #     before_action :authenticate_user!  # Tell devise to use :user map
+      #     before_action :authenticate_admin! # Tell devise to use :admin map
       #
       def self.define_helpers(mapping) #:nodoc:
         mapping = mapping.name
@@ -145,7 +145,7 @@ module Devise
       # the controllers defined inside devise. Useful if you want to apply a before
       # filter to all controllers, except the ones in devise:
       #
-      #   before_filter :my_filter, unless: :devise_controller?
+      #   before_action :my_filter, unless: :devise_controller?
       def devise_controller?
         is_a?(::DeviseController)
       end
diff --git a/lib/devise/failure_app.rb b/lib/devise/failure_app.rb
index bf388185..863be07b 100644
--- a/lib/devise/failure_app.rb
+++ b/lib/devise/failure_app.rb
@@ -6,7 +6,6 @@ module Devise
   # page based on current scope and mapping. If no scope is given, redirect
   # to the default_url.
   class FailureApp < ActionController::Metal
-    include ActionController::RackDelegation
     include ActionController::UrlFor
     include ActionController::Redirecting
 
@@ -22,7 +21,7 @@ module Devise
       @respond.call(env)
     end
 
-    # Try retrieving the URL options from the parent controller (usually 
+    # Try retrieving the URL options from the parent controller (usually
     # ApplicationController). Instance methods are not supported at the moment,
     # so only the class-level attribute is used.
     def self.default_url_options(*args)
@@ -53,18 +52,27 @@ module Devise
     def recall
       config = Rails.application.config
 
-      if config.try(:relative_url_root)
+      header_info = if config.try(:relative_url_root)
         base_path = Pathname.new(config.relative_url_root)
         full_path = Pathname.new(attempted_path)
 
-        env["SCRIPT_NAME"] = config.relative_url_root
-        env["PATH_INFO"] = '/' + full_path.relative_path_from(base_path).to_s
+        { "SCRIPT_NAME" => config.relative_url_root,
+          "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
       else
-        env["PATH_INFO"]  = attempted_path
+        { "PATH_INFO" => attempted_path }
+      end
+
+      header_info.each do | var, value|
+        if request.respond_to?(:set_header)
+          request.set_header(var, value)
+        else
+          env[var]  = value
+        end
       end
 
       flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
-      self.response = recall_app(warden_options[:recall]).call(env)
+      # self.response = recall_app(warden_options[:recall]).call(env)
+      self.response = recall_app(warden_options[:recall]).call(request.env)
     end
 
     def redirect
@@ -199,11 +207,11 @@ module Devise
     end
 
     def warden
-      env['warden']
+      request.respond_to?(:get_header) ? request.get_header("warden") : env["warden"]
     end
 
     def warden_options
-      env['warden.options']
+      request.respond_to?(:get_header) ? request.get_header("warden.options") : env["warden.options"]
     end
 
     def warden_message
diff --git a/lib/devise/models/authenticatable.rb b/lib/devise/models/authenticatable.rb
index 8980b208..f8cc99cd 100644
--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -253,6 +253,7 @@ module Devise
 
         # Find or initialize a record with group of attributes based on a list of required attributes.
         def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
+          attributes = attributes.to_unsafe_h.with_indifferent_access if attributes.respond_to? :to_unsafe_h
           attributes = attributes.slice(*required_attributes).with_indifferent_access
           attributes.delete_if { |key, value| value.blank? }
 
diff --git a/lib/devise/models/confirmable.rb b/lib/devise/models/confirmable.rb
index 33689f0d..cc7bb055 100644
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -316,6 +316,7 @@ module Devise
         # Find a record for confirmation by unconfirmed email field
         def find_by_unconfirmed_email_with_errors(attributes = {})
           unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
+          attributes = attributes.to_unsafe_h if attributes.respond_to? :to_unsafe_h
           unconfirmed_attributes = attributes.symbolize_keys
           unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
           find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
diff --git a/lib/devise/models/database_authenticatable.rb b/lib/devise/models/database_authenticatable.rb
index b155f3d0..27a8646d 100644
--- a/lib/devise/models/database_authenticatable.rb
+++ b/lib/devise/models/database_authenticatable.rb
@@ -39,6 +39,7 @@ module Devise
 
       # Generates password encryption based on the given value.
       def password=(new_password)
+        attribute_will_change! 'password'
         @password = new_password
         self.encrypted_password = password_digest(@password) if @password.present?
       end
diff --git a/lib/devise/rails/routes.rb b/lib/devise/rails/routes.rb
index d40be489..5041c02b 100644
--- a/lib/devise/rails/routes.rb
+++ b/lib/devise/rails/routes.rb
@@ -1,13 +1,10 @@
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"
 
-module ActionDispatch::Routing
-  class RouteSet #:nodoc:
-    # Ensure Devise modules are included only after loading routes, because we
-    # need devise_for mappings already declared to create filters and helpers.
-    def finalize_with_devise!
-      result = finalize_without_devise!
-
+module Devise
+  module RouteSet
+    def finalize!
+      result = super
       @devise_finalized ||= begin
         if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
           warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
@@ -21,10 +18,16 @@ module ActionDispatch::Routing
         Devise.regenerate_helpers!
         true
       end
-
       result
     end
-    alias_method_chain :finalize!, :devise
+  end
+end
+
+module ActionDispatch::Routing
+  class RouteSet #:nodoc:
+    # Ensure Devise modules are included only after loading routes, because we
+    # need devise_for mappings already declared to create filters and helpers.
+    prepend Devise::RouteSet
   end
 
   class Mapper
@@ -105,7 +108,7 @@ module ActionDispatch::Routing
     #      end
     #
     #      class ManagerController < ApplicationController
-    #        before_filter authenticate_manager!
+    #        before_action authenticate_manager!
     #
     #        def show
     #          @manager = current_manager
@@ -428,8 +431,12 @@ options to another `devise_for` call outside the scope. Here is an example:
     end
 ERROR
         end
-
-        path, @scope[:path] = @scope[:path], nil
+        current_scope = @scope.dup
+        if @scope.respond_to? :new
+          @scope = @scope.new path: nil
+        else
+          @scope[:path] = nil
+        end
         path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")
 
         set_omniauth_path_prefix!(path_prefix)
@@ -448,7 +455,7 @@ ERROR
           as: :omniauth_callback,
           via: [:get, :post]
       ensure
-        @scope[:path] = path
+        @scope = current_scope
       end
 
       def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
@@ -457,7 +464,11 @@ ERROR
         exclusive = { as: new_as, path: new_path, module: nil }
         exclusive.merge!(options.slice(:constraints, :defaults, :options))
 
-        exclusive.each_pair { |key, value| @scope[key] = value }
+        if @scope.respond_to? :new
+          @scope = @scope.new exclusive
+        else
+          exclusive.each_pair { |key, value| @scope[key] = value }
+        end
         yield
       ensure
         @scope = current_scope
diff --git a/lib/devise/test_helpers.rb b/lib/devise/test_helpers.rb
index 58fde3df..36f440c0 100644
--- a/lib/devise/test_helpers.rb
+++ b/lib/devise/test_helpers.rb
@@ -16,7 +16,10 @@ module Devise
     # Override process to consider warden.
     def process(*)
       # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } || @response
+      _catch_warden { super } # || @response  # _catch_warden will setup the @response object
+
+      # process needs to return the ActionDispath::TestResponse object
+      @response
     end
 
     # We need to setup the environment variables and the response in the controller.
@@ -109,8 +112,9 @@ module Devise
 
         status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
         @controller.response.headers.merge!(headers)
-        @controller.send :render, status: status, text: response.body,
-          content_type: headers["Content-Type"], location: headers["Location"]
+        r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
+        r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
+        @controller.send :render, r_opts
         nil # causes process return @response
       end
 
@@ -122,7 +126,8 @@ module Devise
         # ensure the controller response is set to our response.
         @controller.response ||= @response
         @response.status = ret.first
-        @response.headers = ret.second
+        @response.headers.clear
+        ret.second.each { |k,v| @response[k] = v }
         @response.body = ret.third
       end
 
diff --git a/lib/generators/active_record/devise_generator.rb b/lib/generators/active_record/devise_generator.rb
index 7394bd84..ff73b971 100644
--- a/lib/generators/active_record/devise_generator.rb
+++ b/lib/generators/active_record/devise_generator.rb
@@ -75,11 +75,11 @@ RUBY
       end
 
       def inet?
-        rails4? && postgresql?
+        postgresql?
       end
 
-      def rails4?
-        Rails.version.start_with? '4'
+      def rails5?
+        Rails.version.start_with? '5'
       end
 
       def postgresql?
diff --git a/lib/generators/devise/orm_helpers.rb b/lib/generators/devise/orm_helpers.rb
index f8f59e49..37228fd9 100644
--- a/lib/generators/devise/orm_helpers.rb
+++ b/lib/generators/devise/orm_helpers.rb
@@ -8,27 +8,10 @@ module Devise
   devise :database_authenticatable, :registerable,
          :recoverable, :rememberable, :trackable, :validatable
 
-CONTENT
-        buffer += <<-CONTENT if needs_attr_accessible?
-  # Setup accessible (or protected) attributes for your model
-  attr_accessible :email, :password, :password_confirmation, :remember_me
-
 CONTENT
         buffer
       end
 
-      def needs_attr_accessible?
-        rails_3? && !strong_parameters_enabled?
-      end
-
-      def rails_3?
-        Rails::VERSION::MAJOR == 3
-      end
-
-      def strong_parameters_enabled?
-        defined?(ActionController::StrongParameters)
-      end
-
       private
 
       def model_exists?
diff --git a/lib/generators/templates/controllers/registrations_controller.rb b/lib/generators/templates/controllers/registrations_controller.rb
index 99f4a799..68de84d7 100644
--- a/lib/generators/templates/controllers/registrations_controller.rb
+++ b/lib/generators/templates/controllers/registrations_controller.rb
@@ -1,6 +1,6 @@
 class <%= @scope_prefix %>RegistrationsController < Devise::RegistrationsController
-# before_filter :configure_sign_up_params, only: [:create]
-# before_filter :configure_account_update_params, only: [:update]
+# before_action :configure_sign_up_params, only: [:create]
+# before_action :configure_account_update_params, only: [:update]
 
   # GET /resource/sign_up
   # def new
diff --git a/lib/generators/templates/controllers/sessions_controller.rb b/lib/generators/templates/controllers/sessions_controller.rb
index 0e2f4507..44f748f7 100644
--- a/lib/generators/templates/controllers/sessions_controller.rb
+++ b/lib/generators/templates/controllers/sessions_controller.rb
@@ -1,5 +1,5 @@
 class <%= @scope_prefix %>SessionsController < Devise::SessionsController
-# before_filter :configure_sign_in_params, only: [:create]
+# before_action :configure_sign_in_params, only: [:create]
 
   # GET /resource/sign_in
   # def new
diff --git a/lib/generators/templates/devise.rb b/lib/generators/templates/devise.rb
index 42720aa5..9356de44 100644
--- a/lib/generators/templates/devise.rb
+++ b/lib/generators/templates/devise.rb
@@ -6,11 +6,7 @@ Devise.setup do |config|
   # confirmation, reset password and unlock tokens in the database.
   # Devise will use the `secret_key_base` on Rails 4+ applications as its `secret_key`
   # by default. You can change it below and use your own secret key.
-<% if rails_4? -%>
   # config.secret_key = '<%= SecureRandom.hex(64) %>'
-<% else -%>
-  config.secret_key = '<%= SecureRandom.hex(64) %>'
-<% end -%>
 
   # ==> Mailer Configuration
   # Configure the e-mail address which will be shown in Devise::Mailer,
diff --git a/test/controllers/custom_registrations_controller_test.rb b/test/controllers/custom_registrations_controller_test.rb
index 0421ad03..60db1f49 100644
--- a/test/controllers/custom_registrations_controller_test.rb
+++ b/test/controllers/custom_registrations_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class CustomRegistrationsControllerTest < ActionController::TestCase
+class CustomRegistrationsControllerTest < Devise::ControllerTestCase
   tests Custom::RegistrationsController
 
   include Devise::TestHelpers
@@ -12,24 +12,24 @@ class CustomRegistrationsControllerTest < ActionController::TestCase
   end
 
   test "yield resource to block on create success" do
-    post :create, { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
+    post :create, params: { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
     assert @controller.create_block_called?, "create failed to yield resource to provided block"
   end
 
   test "yield resource to block on create failure" do
-    post :create, { user: { } }
+    post :create, params: { user: { } }
     assert @controller.create_block_called?, "create failed to yield resource to provided block"
   end
 
   test "yield resource to block on update success" do
     sign_in @user
-    put :update, { user: { current_password: @password } }
+    put :update, params: { user: { current_password: @password } }
     assert @controller.update_block_called?, "update failed to yield resource to provided block"
   end
 
   test "yield resource to block on update failure" do
     sign_in @user
-    put :update, { user: { } }
+    put :update, params: { user: { } }
     assert @controller.update_block_called?, "update failed to yield resource to provided block"
   end
 
diff --git a/test/controllers/custom_strategy_test.rb b/test/controllers/custom_strategy_test.rb
index 798ca777..165f5a2c 100644
--- a/test/controllers/custom_strategy_test.rb
+++ b/test/controllers/custom_strategy_test.rb
@@ -24,7 +24,7 @@ class CustomStrategy < Warden::Strategies::Base
   end
 end
 
-class CustomStrategyTest < ActionController::TestCase
+class CustomStrategyTest < Devise::ControllerTestCase
   tests CustomStrategyController
 
   include Devise::TestHelpers
@@ -41,8 +41,9 @@ class CustomStrategyTest < ActionController::TestCase
     ret = get :new
 
     # check the returned rack array
-    assert ret.is_a?(Array)
-    assert_equal 400, ret.first
+    # assert ret.is_a?(Array)
+    # assert_equal 400, ret.first
+    assert ret.is_a?(ActionDispatch::TestResponse)
 
     # check the saved response as well. This is purely so that the response is available to the testing framework
     # for verification. In production, the above array would be delivered directly to Rack.
@@ -53,8 +54,9 @@ class CustomStrategyTest < ActionController::TestCase
     ret = get :new
 
     # check the returned rack array
-    assert ret.is_a?(Array)
-    assert_equal ret.third['X-FOO'], 'BAR'
+    # assert ret.is_a?(Array)
+    # assert_equal ret.third['X-FOO'], 'BAR'
+    assert ret.is_a?(ActionDispatch::TestResponse)
 
     # check the saved response headers as well.
     assert_equal response.headers['X-FOO'], 'BAR'
diff --git a/test/controllers/helper_methods_test.rb b/test/controllers/helper_methods_test.rb
index ee705017..52fa6b88 100644
--- a/test/controllers/helper_methods_test.rb
+++ b/test/controllers/helper_methods_test.rb
@@ -4,7 +4,7 @@ class ApiController < ActionController::Metal
   include Devise::Controllers::Helpers
 end
 
-class HelperMethodsTest < ActionController::TestCase
+class HelperMethodsTest < Devise::ControllerTestCase
   tests ApiController
 
   test 'includes Devise::Controllers::Helpers' do
diff --git a/test/controllers/helpers_test.rb b/test/controllers/helpers_test.rb
index bae10c25..6df78d9c 100644
--- a/test/controllers/helpers_test.rb
+++ b/test/controllers/helpers_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'
 require 'ostruct'
 
-class ControllerAuthenticatableTest < ActionController::TestCase
+class ControllerAuthenticatableTest < Devise::ControllerTestCase
   tests ApplicationController
 
   def setup
diff --git a/test/controllers/inherited_controller_i18n_messages_test.rb b/test/controllers/inherited_controller_i18n_messages_test.rb
index 66d2df49..677ce30f 100644
--- a/test/controllers/inherited_controller_i18n_messages_test.rb
+++ b/test/controllers/inherited_controller_i18n_messages_test.rb
@@ -14,7 +14,7 @@ class AnotherInheritedController < SessionsInheritedController
   end
 end
 
-class InheritedControllerTest < ActionController::TestCase
+class InheritedControllerTest < Devise::ControllerTestCase
   tests SessionsInheritedController
 
   def setup
@@ -32,7 +32,7 @@ class InheritedControllerTest < ActionController::TestCase
   end
 end
 
-class AnotherInheritedControllerTest < ActionController::TestCase
+class AnotherInheritedControllerTest < Devise::ControllerTestCase
   tests AnotherInheritedController
 
   def setup
diff --git a/test/controllers/internal_helpers_test.rb b/test/controllers/internal_helpers_test.rb
index 2ba50306..47beab92 100644
--- a/test/controllers/internal_helpers_test.rb
+++ b/test/controllers/internal_helpers_test.rb
@@ -3,7 +3,7 @@ require 'test_helper'
 class MyController < DeviseController
 end
 
-class HelpersTest < ActionController::TestCase
+class HelpersTest < Devise::ControllerTestCase
   tests MyController
 
   def setup
@@ -36,18 +36,17 @@ class HelpersTest < ActionController::TestCase
   test 'get resource params from request params using resource name as key' do
     user_params = {'email' => 'shirley@templar.com'}
 
-    params = if Devise.rails4?
-      # Stub controller name so strong parameters can filter properly.
-      # DeviseController does not allow any parameters by default.
-      @controller.stubs(:controller_name).returns(:sessions_controller)
+    # Stub controller name so strong parameters can filter properly.
+    # DeviseController does not allow any parameters by default.
+    @controller.stubs(:controller_name).returns(:sessions_controller)
+
+    params = ActionController::Parameters.new({'user' => user_params})
 
-      ActionController::Parameters.new({'user' => user_params})
-    else
-      HashWithIndifferentAccess.new({'user' => user_params})
-    end
     @controller.stubs(:params).returns(params)
 
-    assert_equal user_params, @controller.send(:resource_params)
+    res_params = @controller.send(:resource_params)
+    res_params = res_params.to_unsafe_h if res_params.respond_to? :to_unsafe_h
+    assert_equal user_params, res_params
   end
 
   test 'resources methods are not controller actions' do
diff --git a/test/controllers/load_hooks_controller_test.rb b/test/controllers/load_hooks_controller_test.rb
index 4f6d9a8e..cf8f4544 100644
--- a/test/controllers/load_hooks_controller_test.rb
+++ b/test/controllers/load_hooks_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class LoadHooksControllerTest < ActionController::TestCase
+class LoadHooksControllerTest < Devise::ControllerTestCase
   setup do
     ActiveSupport.on_load(:devise_controller) do
       define_method :defined_by_load_hook do
diff --git a/test/controllers/passwords_controller_test.rb b/test/controllers/passwords_controller_test.rb
index 383724b8..f8a3f2c8 100644
--- a/test/controllers/passwords_controller_test.rb
+++ b/test/controllers/passwords_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class PasswordsControllerTest < ActionController::TestCase
+class PasswordsControllerTest < Devise::ControllerTestCase
   tests Devise::PasswordsController
   include Devise::TestHelpers
 
@@ -11,8 +11,9 @@ class PasswordsControllerTest < ActionController::TestCase
   end
 
   def put_update_with_params
-    put :update, "user" => {
-      "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
+    put :update, params: { "user" => {
+        "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
+      }
     }
   end
 
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index d931bf83..c224983a 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class SessionsControllerTest < ActionController::TestCase
+class SessionsControllerTest < Devise::ControllerTestCase
   tests Devise::SessionsController
   include Devise::TestHelpers
 
@@ -12,9 +12,10 @@ class SessionsControllerTest < ActionController::TestCase
       request.env["devise.mapping"] = Devise.mappings[:user]
       request.session["user_return_to"] = 'foo.bar'
       create_user
-      post :create, user: {
-        email: "wrong@email.com",
-        password: "wrongpassword"
+      post :create, params: { user: {
+          email: "wrong@email.com",
+          password: "wrongpassword"
+        }
       }
       assert_equal 200, @response.status
     ensure
@@ -37,11 +38,11 @@ class SessionsControllerTest < ActionController::TestCase
 
     user = create_user
     user.confirm
-    post :create, user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { user: {
+        email: user.email,
+        password: user.password
+      }
     }
-
     assert_nil request.session["user_return_to"]
   end
 
@@ -51,9 +52,10 @@ class SessionsControllerTest < ActionController::TestCase
 
     user = create_user
     user.confirm
-    post :create, format: 'json', user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { format: 'json', user: {
+        email: user.email,
+        password: user.password
+      }
     }
 
     assert_equal 'foo.bar', request.session["user_return_to"]
@@ -61,9 +63,10 @@ class SessionsControllerTest < ActionController::TestCase
 
   test "#create doesn't raise exception after Warden authentication fails when TestHelpers included" do
     request.env["devise.mapping"] = Devise.mappings[:user]
-    post :create, user: {
-      email: "nosuchuser@example.com",
-      password: "wevdude"
+    post :create, params: { user: {
+        email: "nosuchuser@example.com",
+        password: "wevdude"
+      }
     }
     assert_equal 200, @response.status
     assert_template "devise/sessions/new"
@@ -73,11 +76,11 @@ class SessionsControllerTest < ActionController::TestCase
     request.env["devise.mapping"] = Devise.mappings[:user]
     user = create_user
     user.confirm
-    post :create, format: 'json', user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { format: 'json', user: {
+        email: user.email,
+        password: user.password
+      }
     }
-
     delete :destroy, format: 'json'
     assert flash[:notice].blank?, "flash[:notice] should be blank, not #{flash[:notice].inspect}"
     assert_equal 204, @response.status
diff --git a/test/controllers/url_helpers_test.rb b/test/controllers/url_helpers_test.rb
index 06895b5d..a4db0901 100644
--- a/test/controllers/url_helpers_test.rb
+++ b/test/controllers/url_helpers_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class RoutesTest < ActionController::TestCase
+class RoutesTest < Devise::ControllerTestCase
   tests ApplicationController
 
   def assert_path_and_url(name, prepend_path=nil)
diff --git a/test/failure_app_test.rb b/test/failure_app_test.rb
index 44ac7671..8919654a 100644
--- a/test/failure_app_test.rb
+++ b/test/failure_app_test.rb
@@ -53,11 +53,16 @@ class FailureTest < ActiveSupport::TestCase
       'REQUEST_METHOD' => 'GET',
       'warden.options' => { scope: :user },
       'rack.session' => {},
-      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime::HTML),
+      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime[:html]),
       'rack.input' => "",
       'warden' => OpenStruct.new(message: nil)
     }.merge!(env_params)
 
+    # Passing nil for action_dispatch.request.formats prevents the default from being used in Rails 5, need to remove it
+    if env.has_key?('action_dispatch.request.formats') && env['action_dispatch.request.formats'].nil?
+      env.delete 'action_dispatch.request.formats' unless env['action_dispatch.request.formats']
+    end
+
     @response = (env.delete(:app) || Devise::FailureApp).call(env).to_a
     @request  = ActionDispatch::Request.new(env)
   end
@@ -164,14 +169,14 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'works for any navigational format' do
       swap Devise, navigational_formats: [:xml] do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => Mime[:xml])
         assert_equal 302, @response.first
       end
     end
 
     test 'redirects the correct format if it is a non-html format request' do
       swap Devise, navigational_formats: [:js] do
-        call_failure('formats' => Mime::JS)
+        call_failure('formats' => Mime[:js])
         assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
       end
     end
@@ -179,18 +184,18 @@ class FailureTest < ActiveSupport::TestCase
 
   context 'For HTTP request' do
     test 'return 401 status' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       assert_equal 401, @response.first
     end
 
     test 'return appropriate body for xml' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
       assert_equal result, @response.last.body
     end
 
     test 'return appropriate body for json' do
-      call_failure('formats' => Mime::JSON)
+      call_failure('formats' => Mime[:json])
       result = %({"error":"You need to sign in or sign up before continuing."})
       assert_equal result, @response.last.body
     end
@@ -201,26 +206,26 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
     end
 
     test 'does not return WWW-authenticate headers if model does not allow' do
       swap Devise, http_authenticatable: false do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => Mime[:xml])
         assert_nil @response.second["WWW-Authenticate"]
       end
     end
 
     test 'works for any non navigational format' do
       swap Devise, navigational_formats: [] do
-        call_failure('formats' => Mime::HTML)
+        call_failure('formats' => Mime[:html])
         assert_equal 401, @response.first
       end
     end
 
     test 'uses the failure message as response body' do
-      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(message: :invalid))
+      call_failure('formats' => Mime[:xml], 'warden' => OpenStruct.new(message: :invalid))
       assert_match '<error>Invalid email or password.</error>', @response.third.body
     end
 
@@ -228,7 +233,7 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is false' do
         test 'dont return 401 with navigational formats' do
           swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
           end
@@ -236,7 +241,7 @@ class FailureTest < ActiveSupport::TestCase
 
         test 'dont return 401 with non navigational formats' do
           swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:json], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
           end
@@ -246,14 +251,14 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is true' do
         test 'return 401' do
           swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 401, @response.first
           end
         end
 
         test 'skip WWW-Authenticate header' do
           swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_nil @response.second['WWW-Authenticate']
           end
         end
diff --git a/test/generators/active_record_generator_test.rb b/test/generators/active_record_generator_test.rb
index e032bd9b..adfa8fd1 100644
--- a/test/generators/active_record_generator_test.rb
+++ b/test/generators/active_record_generator_test.rb
@@ -69,7 +69,6 @@ if DEVISE_ORM == :active_record
     setup :prepare_destination
 
     test "all files are properly created in rails 4.0" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(false)
       simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
         run_generator ["monster"]
 
@@ -80,30 +79,5 @@ if DEVISE_ORM == :active_record
       end
     end
 
-    test "all files are properly created in rails 3.2 when strong_parameters gem is not installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(false)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_match /attr_accessible :email/, content
-        end
-      end
-    end
-
-    test "all files are properly created in rails 3.2 when strong_parameters gem is installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(true)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_no_match /attr_accessible :email/, content
-        end
-      end
-    end
   end
 end
diff --git a/test/helpers/devise_helper_test.rb b/test/helpers/devise_helper_test.rb
index df4b23f4..816d5426 100644
--- a/test/helpers/devise_helper_test.rb
+++ b/test/helpers/devise_helper_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class DeviseHelperTest < ActionDispatch::IntegrationTest
+class DeviseHelperTest < Devise::IntegrationTest
   setup do
     model_labels = { models: { user: "the user" } }
     translations = {
diff --git a/test/integration/authenticatable_test.rb b/test/integration/authenticatable_test.rb
index 8048390b..f22b2871 100644
--- a/test/integration/authenticatable_test.rb
+++ b/test/integration/authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class AuthenticationSanityTest < ActionDispatch::IntegrationTest
+class AuthenticationSanityTest < Devise::IntegrationTest
   test 'home should be accessible without sign in' do
     visit '/'
     assert_response :success
@@ -134,7 +134,7 @@ class AuthenticationSanityTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
+class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'not signed in should not be able to access private route (authenticate denied)' do
     get private_path
     assert_redirected_to new_admin_session_path
@@ -254,7 +254,7 @@ class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
+class AuthenticationRedirectTest < Devise::IntegrationTest
   test 'redirect from warden shows sign in or sign up message' do
     get admins_path
 
@@ -300,7 +300,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
   end
 
   test 'xml http requests does not store urls for redirect' do
-    get users_path, {}, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest'
+    get users_path, headers: { 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest' }
     assert_equal 401, response.status
     assert_nil session[:"user_return_to"]
   end
@@ -317,7 +317,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationSessionTest < ActionDispatch::IntegrationTest
+class AuthenticationSessionTest < Devise::IntegrationTest
   test 'destroyed account is signed out' do
     sign_in_as_user
     get '/users'
@@ -390,7 +390,7 @@ class AuthenticationSessionTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
+class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
   test 'renders the scoped view if turned on and view is available' do
     swap Devise, scoped_views: true do
       assert_raise Webrat::NotFoundError do
@@ -431,7 +431,7 @@ class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationOthersTest < ActionDispatch::IntegrationTest
+class AuthenticationOthersTest < Devise::IntegrationTest
   test 'handles unverified requests gets rid of caches' do
     swap ApplicationController, allow_forgery_protection: true do
       post exhibit_user_url(1)
@@ -472,7 +472,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
 
   test 'sign in with script name' do
     assert_nothing_raised do
-      get new_user_session_path, {}, "SCRIPT_NAME" => "/omg"
+      get new_user_session_path, headers: { "SCRIPT_NAME" => "/omg" }
       fill_in "email", with: "user@test.com"
     end
   end
@@ -509,7 +509,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
 
   test 'sign in with xml format returns xml response' do
     create_user
-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end
@@ -519,13 +519,13 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
     assert_response :success
 
     create_user
-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
     assert_response :success
 
     get new_user_session_path(format: 'xml')
     assert_response :success
 
-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end
@@ -559,7 +559,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
   test 'sign out with non-navigational format via XHR does not redirect' do
     swap Devise, navigational_formats: ['*/*', :html] do
       sign_in_as_user
-      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
+      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
       assert_response :no_content
       assert_not warden.authenticated?(:user)
     end
@@ -569,14 +569,14 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
   test 'sign out with navigational format via XHR does redirect' do
     swap Devise, navigational_formats: ['*/*', :html] do
       sign_in_as_user
-      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "text/html,*/*" }
+      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
       assert_response :redirect
       assert_not warden.authenticated?(:user)
     end
   end
 end
 
-class AuthenticationKeysTest < ActionDispatch::IntegrationTest
+class AuthenticationKeysTest < Devise::IntegrationTest
   test 'missing authentication keys cause authentication to abort' do
     swap Devise, authentication_keys: [:subdomain] do
       sign_in_as_user
@@ -593,7 +593,7 @@ class AuthenticationKeysTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
+class AuthenticationRequestKeysTest < Devise::IntegrationTest
   test 'request keys are used on authentication' do
     host! 'foo.bar.baz'
 
@@ -612,7 +612,17 @@ class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
 
       assert_not warden.authenticated?(:user)
     end
-  end
+  end if Rails.version < '5.0.0'
+
+  test 'invalid request keys raises ActionController::RoutingError' do
+    swap Devise, request_keys: [:unknown_method] do
+      assert_raise ActionController::RoutingError do
+        sign_in_as_user
+      end
+
+      assert_not warden.authenticated?(:user)
+    end
+  end if Rails.version >= '5.0.0'
 
   test 'blank request keys cause authentication to abort' do
     host! 'test.com'
@@ -634,7 +644,7 @@ class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
   end
 end
 
-class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
+class AuthenticationSignOutViaTest < Devise::IntegrationTest
   def sign_in!(scope)
     sign_in_as_admin(visit: send("new_#{scope}_session_path"))
     assert warden.authenticated?(scope)
@@ -689,7 +699,7 @@ class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
   end
 end
 
-class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
+class DoubleAuthenticationRedirectTest < Devise::IntegrationTest
   test 'signed in as user redirects when visiting user sign in page' do
     sign_in_as_user
     get new_user_session_path(format: :html)
@@ -712,7 +722,7 @@ class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
   end
 end
 
-class DoubleSignOutRedirectTest < ActionDispatch::IntegrationTest
+class DoubleSignOutRedirectTest < Devise::IntegrationTest
   test 'sign out after already having signed out redirects to sign in' do
     sign_in_as_user
 
diff --git a/test/integration/confirmable_test.rb b/test/integration/confirmable_test.rb
index d04b00c9..5241517a 100644
--- a/test/integration/confirmable_test.rb
+++ b/test/integration/confirmable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class ConfirmationTest < ActionDispatch::IntegrationTest
+class ConfirmationTest < Devise::IntegrationTest
 
   def visit_user_confirmation_with_token(confirmation_token)
     visit user_confirmation_path(confirmation_token: confirmation_token)
@@ -184,14 +184,14 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
 
   test 'resent confirmation token with valid E-Mail in XML format should return valid response' do
     user = create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), user: { email: user.email }
+    post user_confirmation_path(format: 'xml'), params: { user: { email: user.email } }
     assert_response :success
     assert_equal response.body, {}.to_xml
   end
 
   test 'resent confirmation token with invalid E-Mail in XML format should return invalid response' do
     create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), user: { email: 'invalid.test@test.com' }
+    post user_confirmation_path(format: 'xml'), params: { user: { email: 'invalid.test@test.com' } }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
@@ -213,7 +213,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
   test 'request an account confirmation account with JSON, should return an empty JSON' do
     user = create_user(confirm: false)
 
-    post user_confirmation_path, user: { email: user.email }, format: :json
+    post user_confirmation_path, params: { user: { email: user.email }, format: :json }
     assert_response :success
     assert_equal response.body, {}.to_json
   end
@@ -249,7 +249,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
   end
 end
 
-class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
+class ConfirmationOnChangeTest < Devise::IntegrationTest
   def create_second_admin(options={})
     @admin = nil
     create_admin(options)
diff --git a/test/integration/database_authenticatable_test.rb b/test/integration/database_authenticatable_test.rb
index 18a633d3..578eb4de 100644
--- a/test/integration/database_authenticatable_test.rb
+++ b/test/integration/database_authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class DatabaseAuthenticationTest < ActionDispatch::IntegrationTest
+class DatabaseAuthenticationTest < Devise::IntegrationTest
   test 'sign in with email of different case should succeed when email is in the list of case insensitive keys' do
     create_user(email: 'Foo@Bar.com')
 
diff --git a/test/integration/http_authenticatable_test.rb b/test/integration/http_authenticatable_test.rb
index aad51f62..7efdafe8 100644
--- a/test/integration/http_authenticatable_test.rb
+++ b/test/integration/http_authenticatable_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'
 
-class HttpAuthenticationTest < ActionDispatch::IntegrationTest
+class HttpAuthenticationTest < Devise::IntegrationTest
   test 'handles unverified requests gets rid of caches but continues signed in' do
     swap ApplicationController, allow_forgery_protection: true do
       create_user
-      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}"
+      post exhibit_user_url(1), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}" }
       assert warden.authenticated?(:user)
       assert_equal "User is authenticated", response.body
     end
@@ -89,17 +89,16 @@ class HttpAuthenticationTest < ActionDispatch::IntegrationTest
   end
 
   private
-
     def sign_in_as_new_user_with_http(username="user@test.com", password="12345678")
       user = create_user
-      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
+      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}" }
       user
     end
 
     # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
     def add_oauth2_header
       user = create_user
-      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}"
+      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}" }
     end
 
 end
diff --git a/test/integration/lockable_test.rb b/test/integration/lockable_test.rb
index 0c8c4a79..a13de7a6 100644
--- a/test/integration/lockable_test.rb
+++ b/test/integration/lockable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class LockTest < ActionDispatch::IntegrationTest
+class LockTest < Devise::IntegrationTest
 
   def visit_user_unlock_with_token(unlock_token)
     visit user_unlock_path(unlock_token: unlock_token)
@@ -132,9 +132,10 @@ class LockTest < ActionDispatch::IntegrationTest
     user = create_user(locked: true)
     ActionMailer::Base.deliveries.clear
 
-    post user_unlock_path(format: 'xml'), user: {email: user.email}
+    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
     assert_response :success
     assert_equal response.body, {}.to_xml
+
     assert_equal 1, ActionMailer::Base.deliveries.size
   end
 
@@ -142,7 +143,7 @@ class LockTest < ActionDispatch::IntegrationTest
     user = create_user(locked: false)
     ActionMailer::Base.deliveries.clear
 
-    post user_unlock_path(format: 'xml'), user: {email: user.email}
+    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
     assert_equal 0, ActionMailer::Base.deliveries.size
diff --git a/test/integration/omniauthable_test.rb b/test/integration/omniauthable_test.rb
index 36d2fb15..76c2cdcf 100644
--- a/test/integration/omniauthable_test.rb
+++ b/test/integration/omniauthable_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'
 
 
-class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
+class OmniauthableIntegrationTest < Devise::IntegrationTest
   FACEBOOK_INFO = {
     "id" => '12345',
     "link" => 'http://facebook.com/josevalim',
diff --git a/test/integration/recoverable_test.rb b/test/integration/recoverable_test.rb
index d13caa8f..a26ca758 100644
--- a/test/integration/recoverable_test.rb
+++ b/test/integration/recoverable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class PasswordTest < ActionDispatch::IntegrationTest
+class PasswordTest < Devise::IntegrationTest
 
   def visit_new_password_path
     visit new_user_session_path
@@ -160,8 +160,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
     assert_response :success
     assert_current_url '/users/password'
     assert_have_selector '#error_explanation'
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
     assert_not user.reload.valid_password?('987654321')
   end
 
@@ -251,14 +250,14 @@ class PasswordTest < ActionDispatch::IntegrationTest
 
   test 'reset password request with valid E-Mail in XML format should return valid response' do
     create_user
-    post user_password_path(format: 'xml'), user: {email: "user@test.com"}
+    post user_password_path(format: 'xml'), params: { user: {email: "user@test.com"} }
     assert_response :success
     assert_equal response.body, { }.to_xml
   end
 
   test 'reset password request with invalid E-Mail in XML format should return valid response' do
     create_user
-    post user_password_path(format: 'xml'), user: {email: "invalid.test@test.com"}
+    post user_password_path(format: 'xml'), params: { user: {email: "invalid.test@test.com"} }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
@@ -266,7 +265,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'reset password request with invalid E-Mail in XML format should return empty and valid response' do
     swap Devise, paranoid: true do
       create_user
-      post user_password_path(format: 'xml'), user: {email: "invalid@test.com"}
+      post user_password_path(format: 'xml'), params: { user: {email: "invalid@test.com"} }
       assert_response :success
       assert_equal response.body, { }.to_xml
     end
@@ -275,8 +274,9 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'change password with valid parameters in XML format should return valid response' do
     create_user
     request_forgot_password
-    put user_password_path(format: 'xml'), user: {
+    put user_password_path(format: 'xml'), params: { user: {
       reset_password_token: 'abcdef', password: '987654321', password_confirmation: '987654321'
+      }
     }
     assert_response :success
     assert warden.authenticated?(:user)
@@ -285,7 +285,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'change password with invalid token in XML format should return invalid response' do
     create_user
     request_forgot_password
-    put user_password_path(format: 'xml'), user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'}
+    put user_password_path(format: 'xml'), params: { user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'} }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
@@ -293,7 +293,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'change password with invalid new password in XML format should return invalid response' do
     user = create_user
     request_forgot_password
-    put user_password_path(format: 'xml'), user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'}
+    put user_password_path(format: 'xml'), params: { user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'} }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
@@ -301,7 +301,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test "when using json requests to ask a confirmable request, should not return the object" do
     user = create_user(confirm: false)
 
-    post user_password_path(format: :json), user: { email: user.email }
+    post user_password_path(format: :json), params: { user: { email: user.email } }
 
     assert_response :success
     assert_equal response.body, "{}"
diff --git a/test/integration/registerable_test.rb b/test/integration/registerable_test.rb
index 162ab313..617958d0 100644
--- a/test/integration/registerable_test.rb
+++ b/test/integration/registerable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class RegistrationTest < ActionDispatch::IntegrationTest
+class RegistrationTest < Devise::IntegrationTest
 
   test 'a guest admin should be able to sign in successfully' do
     get new_admin_session_path
@@ -110,8 +110,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
     assert_template 'registrations/new'
     assert_have_selector '#error_explanation'
     assert_contain "Email is invalid"
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
     assert_contain "2 errors prohibited"
     assert_nil User.to_adapter.find_first
 
@@ -217,8 +216,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
     fill_in 'current password', with: '12345678'
     click_button 'Update'
 
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
     assert_not User.to_adapter.find_first.valid_password?('pas123')
   end
 
@@ -259,7 +257,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
   end
 
   test 'an admin sign up with valid information in XML format should return valid response' do
-    post admin_registration_path(format: 'xml'), admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
+    post admin_registration_path(format: 'xml'), params: { admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<admin>)
 
@@ -268,7 +266,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
   end
 
   test 'a user sign up with valid information in XML format should return valid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
+    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
 
@@ -277,21 +275,21 @@ class RegistrationTest < ActionDispatch::IntegrationTest
   end
 
   test 'a user sign up with invalid information in XML format should return invalid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' }
+    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' } }
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
 
   test 'a user update information with valid data in XML format should return valid response' do
     user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: '12345678', email: 'user.new@test.com' }
+    put user_registration_path(format: 'xml'), params: { user: { current_password: '12345678', email: 'user.new@test.com' } }
     assert_response :success
     assert_equal user.reload.email, 'user.new@test.com'
   end
 
   test 'a user update information with invalid data in XML format should return invalid response' do
     user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: 'invalid', email: 'user.new@test.com' }
+    put user_registration_path(format: 'xml'), params: { user: { current_password: 'invalid', email: 'user.new@test.com' } }
     assert_response :unprocessable_entity
     assert_equal user.reload.email, 'user@test.com'
   end
@@ -304,7 +302,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
   end
 end
 
-class ReconfirmableRegistrationTest < ActionDispatch::IntegrationTest
+class ReconfirmableRegistrationTest < Devise::IntegrationTest
   test 'a signed in admin should see a more appropriate flash message when editing their account if reconfirmable is enabled' do
     sign_in_as_admin
     get edit_admin_registration_path
diff --git a/test/integration/rememberable_test.rb b/test/integration/rememberable_test.rb
index a762eb11..39d7e606 100644
--- a/test/integration/rememberable_test.rb
+++ b/test/integration/rememberable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class RememberMeTest < ActionDispatch::IntegrationTest
+class RememberMeTest < Devise::IntegrationTest
   def create_user_and_remember(add_to_token='')
     user = create_user
     user.remember_me!
@@ -10,7 +10,7 @@ class RememberMeTest < ActionDispatch::IntegrationTest
   end
 
   def generate_signed_cookie(raw_cookie)
-    request = ActionDispatch::TestRequest.new
+    request = Devise.rails5? ? ActionDispatch::TestRequest.create : ActionDispatch::TestRequest.new
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
     request.cookie_jar['raw_cookie']
   end
@@ -47,8 +47,10 @@ class RememberMeTest < ActionDispatch::IntegrationTest
       get new_user_session_path
       assert request.session[:_csrf_token]
 
-      post user_session_path, authenticity_token: "oops", user:
-           { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+      post user_session_path, params: {
+          authenticity_token: "oops",
+          user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+        }
       assert_not warden.authenticated?(:user)
       assert_not request.cookies['remember_user_token']
     end
diff --git a/test/integration/timeoutable_test.rb b/test/integration/timeoutable_test.rb
index 1160571c..3c3503dc 100644
--- a/test/integration/timeoutable_test.rb
+++ b/test/integration/timeoutable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class SessionTimeoutTest < ActionDispatch::IntegrationTest
+class SessionTimeoutTest < Devise::IntegrationTest
 
   def last_request_at
     @controller.user_session['last_request_at']
@@ -20,7 +20,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     old_last_request = last_request_at
     assert_not_nil last_request_at
 
-    get users_path, {}, 'devise.skip_trackable' => true
+    get users_path, headers: { 'devise.skip_trackable' => true }
     assert_equal old_last_request, last_request_at
   end
 
@@ -32,7 +32,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     new_time = 2.seconds.from_now
     Time.stubs(:now).returns(new_time)
 
-    get users_path, {}, 'devise.skip_timeoutable' => true
+    get users_path, headers: { 'devise.skip_timeoutable' => true }
     assert_equal old_last_request, last_request_at
   end
 
@@ -115,7 +115,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     user = sign_in_as_user
     get expire_user_path(user)
 
-    post "/users/sign_in", email: user.email, password: "123456"
+    post "/users/sign_in", params: { email: user.email, password: "123456" }
 
     assert_response :redirect
     follow_redirect!
diff --git a/test/integration/trackable_test.rb b/test/integration/trackable_test.rb
index 0dbbee29..4089dd58 100644
--- a/test/integration/trackable_test.rb
+++ b/test/integration/trackable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class TrackableHooksTest < ActionDispatch::IntegrationTest
+class TrackableHooksTest < Devise::IntegrationTest
 
   test "current and last sign in timestamps are updated on each sign in" do
     user = create_user
diff --git a/test/models/validatable_test.rb b/test/models/validatable_test.rb
index 3cd03d86..83f8a430 100644
--- a/test/models/validatable_test.rb
+++ b/test/models/validatable_test.rb
@@ -57,11 +57,7 @@ class ValidatableTest < ActiveSupport::TestCase
     user = new_user(password: 'new_password', password_confirmation: 'blabla')
     assert user.invalid?
 
-    if Devise.rails4?
-      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
-    else
-      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
-    end
+    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
   end
 
   test 'should require password when updating/resetting password' do
@@ -79,11 +75,7 @@ class ValidatableTest < ActiveSupport::TestCase
     user.password_confirmation = 'another_password'
     assert user.invalid?
 
-    if Devise.rails4?
-      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
-    else
-      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
-    end
+    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
   end
 
   test 'should require a password with minimum of 7 characters' do
diff --git a/test/omniauth/url_helpers_test.rb b/test/omniauth/url_helpers_test.rb
index 6f9c80e9..7dfc6280 100644
--- a/test/omniauth/url_helpers_test.rb
+++ b/test/omniauth/url_helpers_test.rb
@@ -1,8 +1,7 @@
 require 'test_helper'
 
 class OmniAuthRoutesTest < ActionController::TestCase
-  ExpectedUrlGeneratiorError = Devise.rails4? ?
-    ActionController::UrlGenerationError : ActionController::RoutingError
+  ExpectedUrlGeneratiorError = ActionController::UrlGenerationError
 
   tests ApplicationController
 
diff --git a/test/orm/active_record.rb b/test/orm/active_record.rb
index 023e3cb7..2386f1fe 100644
--- a/test/orm/active_record.rb
+++ b/test/orm/active_record.rb
@@ -5,6 +5,11 @@ ActiveRecord::Base.include_root_in_json = true
 ActiveRecord::Migrator.migrate(File.expand_path("../../rails_app/db/migrate/", __FILE__))
 
 class ActiveSupport::TestCase
-  self.use_transactional_fixtures = true
+  if Rails.version >= '5.0.0'
+    self.use_transactional_tests = true
+  else
+    self.use_transactional_fixtures = true
+  end
+
   self.use_instantiated_fixtures  = false
 end
diff --git a/test/parameter_sanitizer_test.rb b/test/parameter_sanitizer_test.rb
index f086cf9b..a291580b 100644
--- a/test/parameter_sanitizer_test.rb
+++ b/test/parameter_sanitizer_test.rb
@@ -23,43 +23,57 @@ if defined?(ActionController::StrongParameters)
 
     test 'filters some parameters on sign in by default' do
       sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
-      assert_equal({ "email" => "jose", "password" => "invalid", "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
+      sanitized = sanitizer.sanitize(:sign_in)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "email" => "jose", "password" => "invalid", "remember_me" => "1" }, sanitized)
     end
 
     test 'handles auth keys as a hash' do
       swap Devise, authentication_keys: {email: true} do
         sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-        assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
+        sanitized = sanitizer.sanitize(:sign_in)
+        sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+        assert_equal({ "email" => "jose", "password" => "invalid" }, sanitized)
       end
     end
 
     test 'filters some parameters on sign up by default' do
       sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_up))
+      sanitized = sanitizer.sanitize(:sign_up)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "email" => "jose" }, sanitized)
     end
 
     test 'filters some parameters on account update by default' do
       sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:account_update))
+      sanitized = sanitizer.sanitize(:account_update)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "email" => "jose" }, sanitized)
     end
 
     test 'allows custom hooks' do
       sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
       sanitizer.for(:sign_in) { |user| user.permit(:email, :password) }
-      assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
+      sanitized = sanitizer.sanitize(:sign_in)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "email" => "jose", "password" => "invalid" }, sanitized)
     end
 
     test 'adding multiple permitted parameters' do
       sanitizer = sanitizer(user: { "email" => "jose", "username" => "jose1", "role" => "valid" })
       sanitizer.for(:sign_in).concat([:username, :role])
-      assert_equal({ "email" => "jose", "username" => "jose1", "role" => "valid" }, sanitizer.sanitize(:sign_in))
+      sanitized = sanitizer.sanitize(:sign_in)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "email" => "jose", "username" => "jose1", "role" => "valid" }, sanitized)
     end
 
     test 'removing multiple default parameters' do
       sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
       sanitizer.for(:sign_in).delete(:email)
       sanitizer.for(:sign_in).delete(:password)
-      assert_equal({ "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
+      sanitized = sanitizer.sanitize(:sign_in)
+      sanitized = sanitized.to_h if sanitized.respond_to? :to_h
+      assert_equal({ "remember_me" => "1" }, sanitized)
     end
 
     test 'raises on unknown hooks' do
diff --git a/test/rails_app/app/active_record/user.rb b/test/rails_app/app/active_record/user.rb
index eefe2dd9..431bdf5d 100644
--- a/test/rails_app/app/active_record/user.rb
+++ b/test/rails_app/app/active_record/user.rb
@@ -1,6 +1,9 @@
 require 'shared_user'
+require 'active_model/serializers/xml' if Devise.rails5?
+require 'active_model-serializers' if Devise.rails5?
 
 class User < ActiveRecord::Base
   include Shim
   include SharedUser
+  include ActiveModel::Serializers::Xml if Devise.rails5?
 end
diff --git a/test/rails_app/app/controllers/admins_controller.rb b/test/rails_app/app/controllers/admins_controller.rb
index 6c1fa3b5..6b39be19 100644
--- a/test/rails_app/app/controllers/admins_controller.rb
+++ b/test/rails_app/app/controllers/admins_controller.rb
@@ -1,5 +1,5 @@
 class AdminsController < ApplicationController
-  before_filter :authenticate_admin!
+  before_action :authenticate_admin!
 
   def index
   end
diff --git a/test/rails_app/app/controllers/application_controller.rb b/test/rails_app/app/controllers/application_controller.rb
index 740830dc..fdcce729 100644
--- a/test/rails_app/app/controllers/application_controller.rb
+++ b/test/rails_app/app/controllers/application_controller.rb
@@ -3,8 +3,8 @@
 
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  before_filter :current_user, unless: :devise_controller?
-  before_filter :authenticate_user!, if: :devise_controller?
+  before_action :current_user, unless: :devise_controller?
+  before_action :authenticate_user!, if: :devise_controller?
   respond_to *Mime::SET.map(&:to_sym)
 
   devise_group :commenter, contains: [:user, :admin]
diff --git a/test/rails_app/app/controllers/home_controller.rb b/test/rails_app/app/controllers/home_controller.rb
index c6471953..49ea8b1d 100644
--- a/test/rails_app/app/controllers/home_controller.rb
+++ b/test/rails_app/app/controllers/home_controller.rb
@@ -20,6 +20,10 @@ class HomeController < ApplicationController
   end
 
   def unauthenticated
-    render text: "unauthenticated", status: :unauthorized
+    if Devise.rails5?
+      render body: "unauthenticated", status: :unauthorized
+    else
+      render text: "unauthenticated", status: :unauthorized
+    end
   end
 end
diff --git a/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb b/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
index f6474be2..8d70ac65 100644
--- a/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
+++ b/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
@@ -1,6 +1,6 @@
 class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
   def facebook
-    data = env["omniauth.auth"]
+    data = request.respond_to?(:get_header) ? request.get_header("omniauth.auth") : env["omniauth.auth"]
     session["devise.facebook_data"] = data["extra"]["user_hash"]
     render json: data
   end
@@ -9,6 +9,6 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
     user = User.to_adapter.find_first(email: 'user@test.com')
     user.remember_me = true
     sign_in user
-    render text: ""
+    render (Devise.rails5? ? :body : :text) => ""
   end
 end
diff --git a/test/rails_app/app/controllers/users_controller.rb b/test/rails_app/app/controllers/users_controller.rb
index c1ae874d..420c0104 100644
--- a/test/rails_app/app/controllers/users_controller.rb
+++ b/test/rails_app/app/controllers/users_controller.rb
@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
-  prepend_before_filter :current_user, only: :exhibit
-  before_filter :authenticate_user!, except: [:accept, :exhibit]
+  prepend_before_action :current_user, only: :exhibit
+  before_action :authenticate_user!, except: [:accept, :exhibit]
   respond_to :html, :xml
 
   def index
@@ -13,7 +13,7 @@ class UsersController < ApplicationController
   end
 
   def update_form
-    render text: 'Update'
+    render (Devise.rails5? ? :body : :text) => 'Update'
   end
 
   def accept
@@ -21,11 +21,11 @@ class UsersController < ApplicationController
   end
 
   def exhibit
-    render text: current_user ? "User is authenticated" : "User is not authenticated"
+    render (Devise.rails5? ? :body : :text) => current_user ? "User is authenticated" : "User is not authenticated"
   end
 
   def expire
     user_session['last_request_at'] = 31.minutes.ago.utc
-    render text: 'User will be expired on next request'
+    render (Devise.rails5? ? :body : :text) => 'User will be expired on next request'
   end
 end
diff --git a/test/rails_app/config/application.rb b/test/rails_app/config/application.rb
index 351b7c6a..5cffa873 100644
--- a/test/rails_app/config/application.rb
+++ b/test/rails_app/config/application.rb
@@ -28,7 +28,7 @@ module RailsApp
 
     # Configure sensitive parameters which will be filtered from the log file.
     config.filter_parameters << :password
-    config.assets.enabled = false
+    # config.assets.enabled = false
 
     config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
 
diff --git a/test/rails_app/config/boot.rb b/test/rails_app/config/boot.rb
index 1a479a1a..2d82acf5 100644
--- a/test/rails_app/config/boot.rb
+++ b/test/rails_app/config/boot.rb
@@ -3,9 +3,9 @@ unless defined?(DEVISE_ORM)
 end
 
 module Devise
-  # Detection for minor differences between Rails 3.2 and 4 in tests.
-  def self.rails4?
-    Rails.version.start_with? '4'
+  # Detection for minor differences between Rails 4 and 5 in tests.
+  def self.rails5?
+    Rails.version.start_with? '5'
   end
 end
 
diff --git a/test/rails_app/config/environments/test.rb b/test/rails_app/config/environments/test.rb
index 536b4f09..b2f9f320 100644
--- a/test/rails_app/config/environments/test.rb
+++ b/test/rails_app/config/environments/test.rb
@@ -19,7 +19,12 @@ RailsApp::Application.configure do
   else
     config.serve_static_assets = true
   end
-  config.static_cache_control = "public, max-age=3600"
+
+  if Rails.version >= "5.0.0"
+    config.public_file_server.headers = {'Cache-Control' => 'public, max-age=3600'}
+  else
+    config.static_cache_control = "public, max-age=3600"
+  end
 
   # Show full error reports and disable caching.
   config.consider_all_requests_local       = true
diff --git a/test/rails_app/config/initializers/secret_token.rb b/test/rails_app/config/initializers/secret_token.rb
index 24698914..35818fa1 100644
--- a/test/rails_app/config/initializers/secret_token.rb
+++ b/test/rails_app/config/initializers/secret_token.rb
@@ -1,8 +1,3 @@
 config = Rails.application.config
 
-if Devise.rails4?
-  config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'
-else
-  config.secret_token = 'ea942c41850d502f2c8283e26bdc57829f471bb18224ddff0a192c4f32cdf6cb5aa0d82b3a7a7adbeb640c4b06f3aa1cd5f098162d8240f669b39d6b49680571'
-  config.session_store :cookie_store, key: "_my_app"
-end
+config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'
diff --git a/test/routes_test.rb b/test/routes_test.rb
index d3b3765c..4c6a3a1f 100644
--- a/test/routes_test.rb
+++ b/test/routes_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-ExpectedRoutingError = Devise.rails4? ? MiniTest::Assertion : ActionController::RoutingError
+ExpectedRoutingError = MiniTest::Assertion
 
 class DefaultRoutingTest < ActionController::TestCase
   test 'map new user session' do
@@ -202,37 +202,52 @@ class CustomizedRoutingTest < ActionController::TestCase
   end
 
   test 'map with format false for sessions' do
-    assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in', method: :get})
+    expected_params = {controller: 'devise/sessions', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in.xml', method: :get})
     end
   end
 
   test 'map with format false for passwords' do
-    assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password', method: :post})
+    expected_params = {controller: 'devise/passwords', action: 'create'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/password', method: :post})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password.xml', method: :post})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/password.xml', method: :post})
     end
   end
 
   test 'map with format false for registrations' do
-    assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up', method: :get})
+    expected_params = {controller: 'devise/registrations', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up.xml', method: :get})
     end
   end
 
   test 'map with format false for confirmations' do
-    assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation', method: :get})
+    expected_params = {controller: 'devise/confirmations', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation.xml', method: :get})
     end
   end
 
   test 'map with format false for unlocks' do
-    assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock', method: :get})
+    expected_params = {controller: 'devise/unlocks', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/unlock', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/unlock.xml', method: :get})
     end
   end
 
diff --git a/test/support/http_method_compatibility.rb b/test/support/http_method_compatibility.rb
new file mode 100644
index 00000000..7b8fdf08
--- /dev/null
+++ b/test/support/http_method_compatibility.rb
@@ -0,0 +1,51 @@
+module Devise
+  class IntegrationTest < ActionDispatch::IntegrationTest
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |url, options={}|
+          if options.empty?
+            super url
+          else
+            super url, options
+          end
+        end
+      else
+        define_method(method) do |url, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, url, options[:params] || {}, options[:headers]
+          else
+            super url, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+
+  class ControllerTestCase < ActionController::TestCase
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |action, options={}|
+          if options.empty?
+            super action
+          else
+            super action, options
+          end
+        end
+      else
+        define_method(method) do |action, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, action, options[:params] || {}, options[:headers]
+          else
+            super action, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/test/support/webrat/integrations/rails.rb b/test/support/webrat/integrations/rails.rb
index 03821d26..6f4aedcf 100644
--- a/test/support/webrat/integrations/rails.rb
+++ b/test/support/webrat/integrations/rails.rb
@@ -14,6 +14,15 @@ module Webrat
       ::Rails.logger
     end
   end
+
+  class RailsAdapter
+    protected
+
+    def do_request(http_method, url, data, headers)
+      update_protocol(url)
+      integration_session.send(http_method, normalize_url(url), params: data, headers: headers)
+    end
+  end
 end
 
 module ActionDispatch #:nodoc:
diff --git a/test/test_helpers_test.rb b/test/test_helpers_test.rb
index 2f02b173..31230e35 100644
--- a/test/test_helpers_test.rb
+++ b/test/test_helpers_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class TestHelpersTest < ActionController::TestCase
+class TestHelpersTest < Devise::ControllerTestCase
   tests UsersController
   include Devise::TestHelpers
 
@@ -27,7 +27,7 @@ class TestHelpersTest < ActionController::TestCase
       assert !user.active_for_authentication?
 
       sign_in user
-      get :accept, id: user
+      get :accept, params: { id: user }
       assert_nil assigns(:current_user)
     end
   end
@@ -163,7 +163,7 @@ class TestHelpersTest < ActionController::TestCase
 
   test "creates a new warden proxy if the request object has changed" do
     old_warden_proxy = warden
-    @request = ActionController::TestRequest.new
+    @request = Devise.rails5? ? ActionController::TestRequest.create : ActionController::TestRequest.new
     new_warden_proxy = warden
 
     assert_not_equal old_warden_proxy, new_warden_proxy