So the problem here is after successfully doing the create action, the redirect (which takes you to "thanks") will render as text/plain not text/html. And only if the .popup format is used. And only after a failed login. The server never again replies correctly with text/html until it is restarted.

password_controller.rb

class PasswordsController < Devise::PasswordsController
  caches_page :thanks
  layout "floating_box"

  skip_before_filter :require_active
  before_filter :require_password_token, only: :edit
  before_filter :load_reset_resource, only: :edit
  before_filter :require_reset_resource, only: :edit

  respond_to :html, :popup, only: [:new, :create, :thanks]
  respond_to :html

  def new
    super
  end

  def create
    super
  end

  def thanks
  end

  def edit
  end

  def update
    super
  end

  protected

    # The path used after sending reset password instructions
    def after_sending_reset_password_instructions_path_for(resource_name)
      users_password_thanks_path(format: params[:format])
    end

    def ssl_required?
      ["edit", "update"].include?(action_name)
    end

    def require_password_token
      redirect_to root_path if params[:reset_password_token].blank?
    end

    def load_reset_resource
      self.resource = resource_class.find_by_reset_password_token(params[:reset_password_token])
    end

    def require_reset_resource
      redirect_to new_user_password_url if self.resource.blank?
    end
end

session_controller.rb

class SessionsController < Devise::SessionsController
  layout 'floating_box'

  skip_before_filter :require_active

  respond_to :html, :popup

  def new
    super
  end

  def create
    Errplane.report("sign_in_attempt", message: params.try(:fetch, :user, nil).try(:fetch, :email, nil))

    self.resource = warden.authenticate!(auth_options)

    Errplane.report("successful_sign_in", message: self.resource.email)

    set_flash_message(:notice, :signed_in) if is_navigational_format?
    sign_in(resource_name, resource)

    respond_to(resource) do |format|
      format.html { redirect_to after_sign_in_path_for(resource) }
      format.popup { render text: "<script>self.parent.location.href = \"#{after_sign_in_path_for(resource)}\"</script>" }
    end
  end

  protected

    def ssl_required?
      ["new", "create"].include?(action_name)
    end

    def enforce_ssl
      if action_name == "destroy" || action_name == "new"
        false
      else
        super
      end
    end

    def require_no_authentication
      if user_signed_in?
        respond_to do |format|
          format.html { redirect_to after_sign_in_path_for(current_user) }
          format.popup { render text: "<script>self.parent.location.href = \"#{after_sign_in_path_for(current_user)}\"</script>" }
        end
      end
    end
end