update rails to 4.0.2 (security fix)