Bugfix: was sending the unhashed password reset key in password-reset emails. This should have been changed when I upgraded devise recently.