have acts_as_token_authentication_handler_for raise an exception if you fail to authenticate and don't fall back to devise