Bump yesod-auth upper bound in yesod