Lock devise to 2.2.x, to avoid auto-upgrade to 3

Devise 3 breaks tests, and we want to do that update in a more careful way.