I know it's an old post, but for reference, Devise will try to sign your user in if you call current_user before your controller action is called (for exemple in your application_controller).

There is an issue open on Github: https://github.com/heartcombo/devise/issues/5602