<h1>Sign in</h1>

<%= form_for(resource, as: resource_name, url: session_path(resource_name), html: { class: 'well' }) do |f| %>

  <%= f.label :email %>
  <%= f.email_field :email, class: 'span6' %>

  <%= f.label :password, "Passphrase" %>
  <%= f.password_field :password, class: 'span6' %>

  <% if devise_mapping.rememberable? -%>
    <label class="checkbox" for="remember_me">Remember me?
      <%= f.check_box :remember_me, class: 'checkbox' %>
    </label>
  <% end -%>

  <hr>

  <%= f.submit "Sign in", class: 'btn btn-primary' %>
<% end %>

<%= render "links" %>
<h1>Sign in</h1>

<%= form_for(resource, as: resource_name, url: session_path(resource_name), html: { class: 'well', autocomplete: 'off' }) do |f| %>

  <%= f.label :email %>
  <%= f.email_field :email, class: 'span6', autocomplete: 'off' %>

  <%= f.label :password, "Passphrase" %>
  <%= f.password_field :password, class: 'span6' %>

  <% if devise_mapping.rememberable? -%>
    <label class="checkbox" for="remember_me">Remember me?
      <%= f.check_box :remember_me, class: 'checkbox' %>
    </label>
  <% end -%>

  <hr>

  <%= f.submit "Sign in", class: 'btn btn-primary' %>
<% end %>

<%= render "links" %>
Add autocomplete=off to sign in form
Add autocomplete=off to sign in form

To avoid browser's automatically completing a user's email address, thereby leaving a trail when users have signed in on public computers. Many browsers implemented this as a non-standard attribute on input elements. HTML5 standardises with it on the form element. I've implemented both just to make sure we're covered.
