Require devise in application.rb to avoid "uninitialized constant Devise::SessionsController"
Test that signin is tracked when signing with SessionsController#create and *not* tracked when making token-authenticated request. See #51