Why session controller checked confirmation before validate the password?

```ruby
devise_token_auth (1.2.0)
devise (4.8.0)
```

```ruby
if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
valid_password = @resource.valid_password?(resource_params[:password])
if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
return render_create_error_bad_credentials
end
@token = @resource.create_token
@resource.save

sign_in(:user, @resource, store: false, bypass: false)

yield @resource if block_given?

render_create_success
elsif @resource && !(!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
if @resource.respond_to?(:locked_at) && @resource.locked_at
render_create_error_account_locked
else
render_create_error_not_confirmed
end
else
render_create_error_bad_credentials
end
```

Start at the session controller entry point shown in the issue and reproduce the confirmation-versus-password-validation flow with devise_token_auth 1.2.0 and devise 4.8.0. Determine the expected authentication behavior and document or test the order that should be considered done.

Written by the indexing model from the issue text.