devise_for and devise_scope do not bypass authentication

I'm using rails 3.2.21 and currently upgrading to devise 3.5.10 (from 1.5.4). I have a number of routes defined in a devise_scope :user block.

Here's a sample route; the same thing is happening with other routes in my devise_scope and devise_for blocks:

devise_scope :user do
    get 'register/:purchase_url_path', :controller => :purchases, :action => :new_order, as: :ecommerce, :constraints => { :purchase_url_path => /[\w\.$-@!^]+/ }
end

When I make a request to a page defined by one of these routes, I am redirected to the sign_in page.

I've figured out that the reason for this is in the authenticate_user! method, where

devise_controller?

returns false. Before the upgrade this method was returning true.

Before the devise upgrade, executing 'PurchasesController.ancestors' in irb returns a list including:

Devise::Controllers::InternalHelpers,
Devise::Controllers::ScopedViews,
Devise::Controllers::SharedHelpers,

After the upgrade those items are not present.

What have I done wrong?