Make sure you cleared cookies after upgrading Rails. It's not Devise, you may just have a session cookie in old format, insecure