relaxed bounds for ghc 781

This patch works for us. yesod-auth should be bumped to 1.3 though.
Good catch. This would need conditional compilation to keep working on 1.2