Upgrade rack-protection to workaround issues with recent Chrome updates

Fixes https://github.com/swanson/stringer/issues/335
Merge pull request #339 from pascalw/bugfix-335-rack-protection

Upgrade rack-protection to workaround issues with recent Chrome updates
Replace highline dependency with standard Ruby

There are two minor differences from the `highline` version.

* Character echoing on password input has been disabled altogether.

  This is due to limitations of the `console/io` library.

* The password length validation has been removed.

  There's no feature like this in the `console/io` library and there's no
  validation like this on the model. Instead of reimplementing it, I think we
  might as well remove it.

The test for `ChangePassword` could use some improvement, especially to avoid
stubbing a method on the object under test.

The change to `ChangeUserPassword` is tangential, but fixes a bug where the
password wouldn't be updated due to a failing validation (`password` and
`password_confirmation` don't match).
Merge pull request #340 from Koronen/remove-highline-dependency

Replace highline dependency with standard Ruby
Merge branch 'master' of github.com:swanson/stringer into tweak