require new devise, so we don't need to care about token auth
require new rails so we can use encrypted cookies