relaxed bounds for ghc 781

This patch works for us. yesod-auth should be bumped to 1.3 though.
I'm confused here -- your comment says this lower bound should be 1.3 (and I agree), right? Why didn't that change make it into this PR before merge?