Changed regexp that prevent XSS

Hello there.

I found strange issue, using ```Devise.email_regexp``` method, specially using this way:
```validates :email, format: { with: Devise.email_regexp }, allow_blank: true``` allows to create user like ```"dave.davison@example.com<b>XSS<b>"```.

As i can see by search through github repositories: [search result](https://github.com/search?q=Devise.email_regexp&type=Code&utf8=%E2%9C%93), there's thousands using this functionality.

We're using sinatra, and SOA architecture, and after penetration testing from security company i found this issue, and users in DB (and any other data that contains email) with XSS vulnerability.

I tested this regexp with a couple of expressions, and decided to left regexp from [Apidock](http://apidock.com/rails/ActiveModel/Validations/ClassMethods/validates_format_of)

Instead of ```<b></b>``` could be ```<script></script>```. :)
What do you think, guys?