add :tokens to devise serialization blacklist