depends on spree 1.2.3

Spree needed upgrading to 1.2.3 for a Rails security release.