Authlogic has no roles either, I use acl9.

Authlogic and forgotten passwords is pretty simple, though. It sort of gives it to you. Well, it gives you the tools. It's really only a tiny bit of coding.

I'll certainly check out Devise though.