I just published an article on Rails login security. It describes a login flow that uses CAPTCHA in a combination with the Devise lockable module to deliver a painless yet secure sign in experience for your users.