This is because devise uses flash to store logic, instead of only information that has to be given to the user. The 'timedout' key has been removed from the flash hash. This should be reverted when devise changes this.