这是我们的扩展的sessions_controller代码.它适用于成功和失败的登录尝试：

# CUSTOM (Mix of actual devise controller method and ajax customization from http://natashatherobot.com/devise-rails-sign-in/):
  def create
    # (NOTE: If user is not confirmed,execution will never get this far...)
    respond_to do |format|
      format.html do 
        # Copied from original create method:
        self.resource = warden.authenticate!(auth_options)
        set_flash_message(:notice,:signed_in) if is_navigational_format?
        sign_in(resource_name,resource)
        respond_with resource,:location => after_sign_in_path_for(resource)
      end                       
      format.js  do
        # Derived from Natasha AJAX recipe:
        self.resource = warden.authenticate!(:scope => resource_name,:recall => "#{controller_path}#failure")
        sign_in(resource_name,resource)
        return render :json => {:success => true,:token => form_authenticity_token() },content_type: "application/json" # Need to explicitely set content type to JSON,otherwise it gets set as application/javascript and success handler never gets hit.
      end          
    end

  end

  def failure
    return render :json => {:success => false,:errors => ["Login Failed."]}
  end

问题是,如果用户未经确认,则create方法永远不会被命中.重定向发生在之前的某个地方,这意味着我们无法以JS友好的方式处理它.但是通过源代码我找不到任何可以进行确认检查的过滤器.确认检查在哪里发生,我们如何拦截它？