update tests so they work with Devise 3.2

Resolves #2671

Devise 3.1 introduced `allow_insecure_token_lookup`, but 3.2 took it
away :/

Oh well, at least the tests are passing now.

Conflicts:
	features/support/paths.rb
Fix nested resource name in breadcrumbs

Fixes #2132.

Conflicts:
	spec/unit/view_helpers/breadcrumbs_spec.rb