diff --git a/test/test_authenticatable.rb b/test/test_authenticatable.rb
new file mode 100644
index 0000000..ed4f3e2
--- /dev/null
+++ b/test/test_authenticatable.rb
@@ -0,0 +1,161 @@
+require 'minitest/autorun'
+require 'prism'
+require 'support'
+require 'tmpdir'
+
+class AuthSessionsController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser
+
+  def create
+    user = AuthUser.find_by(email: params['email'])
+    if user && user.authenticate(params['password'])
+      sign_in(user)
+      halt(200, after_authentication_url)
+    else
+      halt(401, 'invalid credentials')
+    end
+  end
+
+  def destroy
+    sign_out
+    halt(200, 'signed out')
+  end
+end
+
+class AuthDashboardController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in'
+  before_action :require_authentication
+
+  def index
+    halt(200, "hello #{current_user.email}")
+  end
+end
+
+class AuthApiController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser
+  before_action :require_authentication
+
+  def index
+    halt(200, "hello #{current_user.email}")
+  end
+end
+
+class AuthRememberSessionsController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, remember_cookie: :remember_token
+
+  def create
+    user = AuthUser.find_by(email: params['email'])
+    if user && user.authenticate(params['password'])
+      sign_in(user, remember: params['remember'] == '1')
+      halt(200, 'signed in')
+    else
+      halt(401, 'invalid credentials')
+    end
+  end
+
+  def destroy
+    sign_out
+    halt(200, 'signed out')
+  end
+end
+
+class AuthRememberDashboardController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in', remember_cookie: :remember_token
+  before_action :require_authentication
+
+  def index
+    halt(200, "hello #{current_user.email}")
+  end
+end
+
+# `authenticate_with` is declared only on the base class here, the way a
+# real app declares it once on ApplicationController - proving the setting
+# (and its unauthenticated_redirect_path) reaches a subclass that never
+# calls `authenticate_with` itself.
+class AuthBaseController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in'
+end
+
+class AuthInheritedController < AuthBaseController
+  before_action :require_authentication
+
+  def index
+    halt(200, "hello #{current_user.email}")
+  end
+end
+
+class AuthMultiSessionsController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, remember_sessions: :AuthLoginSession
+
+  def create
+    user = AuthUser.find_by(email: params['email'])
+    if user && user.authenticate(params['password'])
+      sign_in(user, remember: params['remember'] == '1')
+      halt(200, 'signed in')
+    else
+      halt(401, 'invalid credentials')
+    end
+  end
+
+  def destroy
+    sign_out
+    halt(200, 'signed out')
+  end
+end
+
+class AuthMultiDashboardController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in', remember_sessions: :AuthLoginSession
+  before_action :require_authentication
+
+  def index
+    halt(200, "hello #{current_user.email}")
+  end
+
+  def other_devices
+    halt(200, other_login_sessions.count.to_s)
+  end
+
+  def sign_out_others
+    sign_out_all_other_sessions
+    halt(200, other_login_sessions.count.to_s)
+  end
+
+  def revoke
+    # Deliberately the raw String params['id'] gives, not params['id'].to_i -
+    # a real controller (see examples/blog's LoginSessionsController) has no
+    # reason to convert it itself; revoke_login_session! must do that on its
+    # own or every real HTTP request would silently no-op (see its comment).
+    ok = revoke_login_session!(params['id'])
+    halt(ok ? 200 : 404, ok ? 'revoked' : 'not found')
+  end
+end
+
+class AuthCappedSessionsController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, remember_sessions: :AuthLoginSession, max_remember_sessions: 2
+
+  def create
+    user = AuthUser.find_by(email: params['email'])
+    if user && user.authenticate(params['password'])
+      sign_in(user, remember: true)
+      halt(200, 'signed in')
+    else
+      halt(401, 'invalid credentials')
+    end
+  end
+end
+
+class AuthCappedDashboardController < Prism::Controller
+  include Prism::Authenticatable
+  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in',
+                     remember_sessions: :AuthLoginSession, max_remember_sessions: 2
+  before_action :require_authentication
+