devise csrf token fixation attacks protection security alert

There is a fix for devise 3 and up but not our version.