update to devise 3

The new token logic for confirmation emails requires users to use @token
instead if @user.confirmation_token in mailer views.

Note that this commit removes the token_authenticatable option for
devise. If this is still needed, we need to find a solution as described
here:

  https://gist.github.com/josevalim/fb706b1e933ef01e4fb6
  https://github.com/aaronchi/simple_token_authentication
  http://blog.plataformatec.com.br/2013/08/devise-3-1-now-with-more-secure-defaults/
devise: sign in user after account confirmation

This is potentially unsafe, but removes the necessity to login after
the link in the email was clicked.