Devise itself is a Rails engine and you can override any of its functionality by creating a copy of the file you wish to change in your local directory. When Rails begins to look for an appropriate controller for a request, it will first check the local application, then vendor/gems, and then the loaded gems themselves.
In the case of Devise, they mention that modifying controllers should be done in this way:
Configuring controllers
If the customization at the views level is not enough, you can customize each controller by following these steps:
1) Create your custom controller, for
example a Admins::SessionsController:
class Admins::SessionsController < Devise::SessionsController
end
2) Tell the router to use this controller:
devise_for :admins, :controllers => { :sessions => "admins/sessions" }
3) And since we changed the controller, it won’t use the "devise/sessions" views, so remember to copy "devise/sessions" to "admin/sessions".
Remember that Devise uses flash messages to let users know if sign in was successful or failed. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
Here is the source of the quote: https://github.com/plataformatec/devise