support deep session content object in devise authenticator, see #319