Allow resource owner credentials with devise session