performance and security fixes

Apparently it didn't get removed after the rename to ExtractsPath.

make devise controllers use devise layout

Reject ssh keys that break gitolite

Improve performance of Commits#show

Also, just for extra paranoia, only call safe_message once in the
decorator methods

Adds specs to make sure it still works