Fixed: devise confirmable, return url; plus, tied up cms authentication to devise.