I noticed that devise uses (under the hood) essentially an update_all on the user, to increment the failed_attempts. This means that there is no after_commit hook on the use