Security fix: update devise