The approval and suspended routes are actually used. Take a look at force_approved_account and redirect_suspended_account methods on the application controller