update to respect the new asset namespacing

Related to spree/spree#4050

introduced here: https://github.com/spree/spree/commit/cfbd0f346ee89ea252ef3dfe8f7779ebacc3b875
Bump to Devise 3.2.2
Remove :token_authenticatable from model, as Devise 3.1 deprecated it
Remove Spree::User.anonymous!

This appears to no longer have a use within Spree itself. Orders seem content to have an email associated with them, but no user associated
Use EmailValidator.valid? to check if email is valid in CheckoutController#update_registration

Conflicts:
	app/controllers/spree/checkout_controller_decorator.rb
Remove token_authentication_key, given it is now deprecated
Return warning for when people have not configured Devise.secret_token
Remove ancient commented out code from admin/users_controller
Update user password reset to work with Devise 3.2.2

Conflicts:
	app/mailers/spree/user_mailer.rb
	app/models/spree/user.rb
Remove attr_accessible comments from User model
Order email tests already exist within core

No need to have them duplicated in auth as well
Spree::UserMailer tests now need to pass TWO arguments

Conflicts:
	spec/mailers/user_mailer_spec.rb
Remove unnecessary pending test from users_controller_spec
Fix argument list expected for reset_password_instructions in user_spec

Conflicts:
	spec/models/user_spec.rb
Clear all AM deliveries before all tests
Add installer to setup Devise's secret_token
Update README to mention installer
Correct number of arguments in reset_password_instructions call in user_mailer_spec
we can do the signup promotion with the new promotion system out of the box

Fixes #148
Remove friendly_token and generate_token methods which do not appear to be used anywhere