title: Why won't Devise allow unconfirmed users to login even when allow_unconfirmed_access_for is set?
body: <p>We have an existing user base and are adding email confirmation.  Confirmation is optional but will allow additional features.  Users are not required to confirm.  I've added the confirmable module and ran migrations.  Confirmation works as advertised.</p>
  <p>But, users cannot log in since they are not confirmed.  All current users have nil confirmation values, which is what we want (users can go back and confirm their email at any time).  I've followed all the Devise wiki articles and set allow_unconfirmed_access_for in the initializer:</p>
  <pre><code>config.allow_unconfirmed_access_for = 10.years 
  </code></pre>
  <p>I've also tried setting it in our user model as well:</p>
  <pre><code>devise :confirmable, allow_unconfirmed_access_for: 10.years
  </code></pre>
  <p>I've also tried using other values (1.year, 500.days, etc.)</p>
  <p>My <code>SessionsController</code>, which does not differ much from Devise's method (<a href="https://github.com/plataformatec/devise/blob/master/app/controllers/devise/sessions_controller.rb" rel="nofollow noreferrer">here on github</a>)</p>
  <pre><code>class Users::SessionsController &lt; Devise::SessionsController
    respond_to :json
  
    def new
      redirect_to &quot;/#login&quot;
    end
  
    def create
      resource = warden.authenticate(auth_options)
      if !resource
        render json: {error: &quot;Invalid email or password&quot; }, status: 401 and return
      end
  
      sign_in(resource_name, resource)
      render &quot;sign_in&quot;, formats: [:json], locals: { object: resource }
    end
  end
  </code></pre>
  <p>Devise's the response:</p>
  <blockquote>
  <p>{&quot;error&quot;: &quot;You have to confirm your account before continuing.&quot;}</p>
  </blockquote>
  <p><code>Devise 2.1.2</code> with <code>Rails 3.2.9.</code></p>