Devise has been my choice in recent times. but beware it has no roles. it's simple and bakes in everything though. so in 2 commands in the terminal you'll see a login system in your browser including forgot password feature that authlogic doesn't give you.
Making all of those features Samparicio said would be a little tough for code reuse. Engines feature was planned for Rails 3.0 beta but pushed to 3.x. That's the feature that can help code reuse. But it's possible to do this neatly on Django, which allows component-based architecture for apps.
Authlogic and forgotten passwords is pretty simple, though. It sort of gives it to you. Well, it gives you the tools. It's really only a tiny bit of coding.
