rails 4.0, update devise, fix secret token handling, fix spec tests