Problem when using 2 types of authentication on same site

[shartep]

Can somebody explain why we need if condition in this line

simple_token_authentication/lib/simple_token_authentication/exception_fallback_handler.rb

Line 8 in 2ea7d13

throw(:warden, scope: entity.name_underscore.to_sym) if controller.send("current_#{entity.name_underscore}").nil?

?

Here is my case: I working on web site, it have admin panel (active_admin) and I use classic devise solution for authentication via session. Other part of is a single-page application, so I start implementing REST API on backend for support this SPA. I decide to use token base authentication for REST API part, add acts_as_token_authentication_handler_for User, fallback: :exception

So I login via classic devise sign_in view, then generate token and send it to SPA.

When I make requests from SPA to my REST API with wrong credentials this request are still OK, it happens because exception is not throws in this line (see link above), reason of this is that controller.send("current_#{entity.name_underscore}") return User instance, because request from client also include cookies with session_id.