@yuhunglin But FWIW, Devise is doing nothing since I removed its entry from routes.rb. To be sure, I ran rake routes and confirmed that it hasn't enabled any back doors.