Update devise to 3.1.1, and remove token_authenticatable module

Remove `token_authenticatable`, to get rid of the devise warning about it, and be in a better shape for future upgrades.

on http://blog.plataformatec.com.br/2013/08/devise-3-1-now-with-more-secure-defaults/ we can see that they deprecated the module `token_authenticatable`, which is going to be removed on version 3.2 .
So we need to use our strategy of token look up.

In the future we should also change the lookup mechanism to receive an email, so we can lookup by email, and check the token afterwards to avoid timing attacks.

please review @shingara