Fixed some issues, pull review raised.

app/controllers/sessions_controller.rb

@@ -4,6 +4,7 @@ class SessionsController < Devise::SessionsController
 
   # TODO XXX THIS IS A VERY DIRTY WORKAROUND!!
   if Settings.dirty_rails4_warden_workaround
+    # Authenticate user and create a session.
     def create
       # Manually do the Mailbox lookup, because I could not get
       # warden.authenticate! to work.
@@ -21,7 +22,7 @@ def create
       # From here it's original devise code again..
       set_flash_message(:notice, :signed_in) if is_navigational_format?
       sign_in(resource_name, resource)
-      respond_with resource, :location => after_sign_in_path_for(resource)
+      respond_with resource, location: after_sign_in_path_for(resource)
     end
   end
 

app/models/mailbox.rb

@@ -2,7 +2,10 @@
 class Mailbox < ActiveRecord::Base
   include Address
 
+  # Parameters, any user can change.
   PARAMS = %i[email name password password_confirmation]
+
+  # Parameters, only admin or manager users can change.
   PARAMS_ADMIN = PARAMS + %i[active admin domain_id mail_location quota username]
 
   belongs_to :domain

config/initializers/devise.rb

@@ -24,7 +24,7 @@
   # session. If you need permissions, you should implement that in a before filter.
   # You can also supply a hash where the value is a boolean determining whether
   # or not authentication should be aborted when the value is not present.
-  config.authentication_keys = [ :username, :domain_id ]
+  config.authentication_keys = [:username, :domain_id]
 
   # Configure parameters from the request object used for authentication. Each entry
   # given should be a request method and it will automatically be passed to the
@@ -36,12 +36,12 @@
   # Configure which authentication keys should be case-insensitive.
   # These keys will be downcased upon creating or modifying a user and when used
   # to authenticate or find a user. Default is :email.
-  config.case_insensitive_keys = [ :username ]
+  config.case_insensitive_keys = [:username]
 
   # Configure which authentication keys should have whitespace stripped.
   # These keys will have whitespace before and after removed upon creating or
   # modifying a user and when used to authenticate or find a user. Default is :email.
-  config.strip_whitespace_keys = [ :username ]
+  config.strip_whitespace_keys = [:username]
 
   # Tell if authentication through request.params is enabled. True by default.
   # It can be set to an array that will enable params authentication only for the

test/functional/sessions_controller_test.rb

@@ -38,7 +38,7 @@ class SessionsControllerTest < ActionController::TestCase
 
         should respond_with :redirect
         should redirect_to :new_mailbox_session
-        should set_the_flash.to /invalid email or password/i
+        should set_the_flash.to(/invalid email or password/i)
       end
     end
   end