Bump ActiveRecord to 4.0.2

* This addresses a theoretical-for-Bouncer security vulnerability
  https://groups.google.com/forum/#!topic/rubyonrails-security/pLrh6DUw998