Use devise for firms

Still need to consider if we really want confirmation emails sent as part of `Firm#create`, we'll discuss the data import side with @benlovell after lunch
At this stage all we really need is `confirmable` and perhaps `validatable`. They won't even be providing a password and confirmation for the initial delivery and there won't be any login capability. It's just really to capture their email address and verify its validity.