i've admittedly only skimmed the (long) article for now, but it's a great reference and really shows how much thought needs to go into user authentication flows. i've done this kind of custom implementation in the past and it was definitely a great learning experience, but i'm not sure i'd trust my code to withstand a serious attack.

they basically recreated a simpler but not-as-flexible (yet?) devise. the flexibility/adaptability of devise seems to be where all the extra complexity comes from. i'm just waiting to see this released as a gem, and the cycle to start anew... =)