lock activesupport to 3.x; 4.x requires ruby 1.9.3

we should be on 1.9.3 anyway but this wasn't meant to be bumped