title: Devise authentication fails with 401 error
body: <p>I just switched from Sorcery to Devise.  Sorcery is semi-inactive and although authentication is working in rails 5---test helpers are not.  So, I decided to make the switch the Devise.  I've been getting the dreaded 401 error:</p>
  
  <pre><code>Completed 401 Unauthorized
  </code></pre>
  
  <p>I have seen many questions regarding this...but, none of those answers helped me.</p>
  
  <p>My question is a bit misleading because you will immediately assume I have some remnants of the Sorcery install.  I might, but Ive thoroughly checked it all.  </p>
  
  <p>1 - If I use the forgot password functionality within Devise I will be auto logged in after changing my password---However, I can not log in using those sme credentials...get the 401 error.</p>
  
  <p>2 - If I completely clear existing passwords (because I'm pretty sure sorcery encryption is diff than devise encryption) and update password using devise OR </p>
  
  <p>3 - I have traced the path taken for authentication inside Devise and my problem surfaces when the following method is hit:</p>
  
  <pre><code>def valid_password?(password)
    Devise::Encryptor.compare(self.class, encrypted_password, password)
  end
  </code></pre>
  
  <p>It seems that encrypted_password != password even though the password was successfully updated using devise.</p>
  
  <p>As part of following the auth path inside Devise I should also point out that I am using the Devise method user.skip_confirmation! which manually confirms the user---so, user confirmation should not be part of this issue.</p>
  
  <p>I am using custom Devise views (although have not altered them yet).  I have also generated a custom sessions controller because I think/thought this issue might be related to Pundit policy.  However, I am skipping policy verification in the application controller using the following...so, Pundit should not be a problem:</p>
  
  <pre><code>after_action :verify_authorized, except: :index, unless: :devise_controller?
  after_action :verify_policy_scoped, only: :index, unless: :devise_controller?
  </code></pre>
  
  <p>cookies_serializer has been brought up a number of times in other answers...I have tried :json, :marshal, and :hybrid with no affect.</p>
  
  <p>So, authentication is failing because Devise::Encryptor.compare(self.class, encrypted_password, password) returns false.  But, if Devise saved the new password---how can compare not return true.  And, yes---I have entering the credentials correctly.</p>
  
  <p>Thanks for the help!</p>