I was testing this gem, and when I generate a sample app with the --lockable flag, it looks like the before_action to call require_lock is only added to the password reset, but it should also be added to at least to the sessions controller too I believe.
Otherwise, it gives a false sense of being safe from password brute-force attacks.