SaltedHashLoginGenerator - strange behaviour?

I have integrated this generator into my code but I am having problems understanding how it works. Specifically, I am observing what I think is strange, unexpected behaviour. For example,

1) I enter my chosen application URL expecting to be forced to log in 2) I get routed to the login page as expected

In response to (1) my logger.info statements indicate that the user_system.login_required method is called (expected) and that this method calls user_system.protect? (expected)which returns true (I have not overridden the default code). The user is then re-directed to the login action (expected) and the log file claims that the filter chain is broken as login required returns false (expected, I think).

The log files then indicate that "login_required" is again called in response to the re-direct (2) but this time the user_system.protect? method is not called. I am trying to understand why this is the case as I would expect it to be called as there appears to be no significant difference to the first request.

Can anyone help or point me in the direction of a good source of information?