update tests so they work with Devise 3.2

Resolves #2671

Devise 3.1 introduced `allow_insecure_token_lookup`, but 3.2 took it
away :/

Oh well, at least the tests are passing now.