Houdini/two_factor_authentication — pull request #7 by wojt-eu (2012-12-21 10:54:35+00:00)
Title: Respond with 401 for request non-HTML requests [#6]

@Houdini can you take at the solution? Is it missing something important?

Responding with empty body and just 401 status is pretty lame. It's a catch-all so neither plain text "Failed second factor auth" nor JSON "{message: "Failed second factor auth"} seems appropriate. I think that's ok because easily override handle_failed_second in your ApplicationController to fit your needs.