devise vulnerability update: 1.3.x & 1.2.x are ok

thx to @pascalvanhecke, fixes #7