It turns out find_for_database_authentication calls find_for_authentication, not the other way around.

spec/models/user_spec.rb

@@ -409,18 +409,22 @@ describe User do
     end
   end
 
-  describe ".find_for_authentication" do
+  describe ".find_for_database_authentication" do
     it 'finds a user' do
-      User.find_for_authentication(:username => alice.username).should == alice
+      User.find_for_database_authentication(:username => alice.username).should == alice
+    end
+
+    it 'finds a user by email' do
+      User.find_for_database_authentication(:username => alice.email).should == alice
     end
 
     it "does not preserve case" do
-      User.find_for_authentication(:username => alice.username.upcase).should == alice
+      User.find_for_database_authentication(:username => alice.username.upcase).should == alice
     end
 
     it 'errors out when passed a non-hash' do
       lambda {
-        User.find_for_authentication(alice.username)
+        User.find_for_database_authentication(alice.username)
       }.should raise_error
     end
   end