Prevent hijacking of already confirmed accounts
When working with this setup I discovered that once I person has clicked a confirmation link the token will no longer be valid and will return a nil object, this is my addition for fixing this problem.
Add syntax highlighting to code samples
re-arrange the introductory text so the credit comes last
re-write the introductory text for clarity
added except in update_attributes for confirmation_token. Writing it was triggering a mass assignment error, which arguably makes sense as the user has no reason to be setting the confirmation token.
Never mind, I guess it calls super
Noticed that it used resource_class.confirm_by_token rather than resource_class.find_by_confirmation_token in app/controllers/devise/confirmations_controller.rb
Re-write text a bit to clarify -- no change to code.
Filename should be confirmations_controller.rb
remove extraneous reference to sessions controller and remove mention of probbaly optional method in model
change title to more descriptive objective