Oh, you're right. Maybe using `:only => :update`. Problem I noticed is that the callback wasn't even being triggered, the only reason the user gets re-authenticated is due to the block I removed. That's why you was getting signed in as the modified user instead of the user in session.