Exclude Devise versions vulnerable to CVE-2013-0233

Fixes #2744, closes #2745