fix #16, device/device_updated in login response

other:
- require 'device', 'ver' for each request
- comment /list_tag_users