Add Devise for authentication

We'll assume that authentication is the responsibility of the
upstream app.  We'll require Devise to function upstream and use it
to verify authentication.

This does not include an access-control mechanism.  We'll address
that in another changeset.

KriKri's application controller requires authentication for all
resources.

This adds a KriKri User model that extends the wrapper
application's User model.