Update lots of gems
Fix session route names.

This bug may have existed before the Devise update. After getting a 403
response back from Google OAuth2 devise was redirecting to
new_session_path, which did not exist.