Ensure that kandan is using a version of Devise that supports :token_authenticatable

The latest version of Devise brake the current kandan code due to the removal of :token_authenticatable. Until the codebase is upgraded this changes  lock Devise to a pre-removal version.