NoamB/sorcery — pull request #249 by foohey (2012-04-02 06:40:49+00:00)
Title: Added unlock token sent by email for bruteforce protection

I think lock_time_period without notification is too aggressive, I've added the unlock by token feature.

Here the specs results: https://gist.github.com/2532d5efc308c6b7e6bc
A few new options: https://gist.github.com/90bbc15c71a036bfd45e

UserMailer method:

```ruby
def send_unlock_token_email(user)
@user = user
mail(to: user.email, subject: "Your account has been locked due to many wrong logins")
end
```

```haml
Your account has been locked due to many wrong logins !
%br/
Please click #{link_to("here", users_unlock_url(@user.unlock_token))} to unlock your account
````

Controller unlock action:

```ruby
def unlock
@user = User.load_from_unlock_token(params[:token])
if @user
@user.unlock!
auto_login(@user)
redirect_to profile_index_path, notice: "Your account has been unlocked !"
else
flash[:alert] = "Unlock token not found"
not_authenticated
end
end
```

this is my first educational & contribution to a Rails plugin & github, so I hope I followed the right way but I know this is not perfect (but working !)