upgrade: upgrade Devise to latest (3.2) release and remove token authentication to replace with default session management via cookies