fix(security): sync with upstream 1.8.1 + relax devise constraint for 5.x#4

Mat-Bit merged 8 commits intomaintrusted/tiddle:mainfrom

security/sync-and-devise-5-compattrusted/tiddle:security/sync-and-devise-5-compatCopy head branch name to clipboard