update devise & bcrypt
allows passing token via HTTP headers