application controller update

for permitted devise actions