Serve static assets on production (heroku)
Upgrade to rails 4.0.0.rc1, bump gem verions

Note: Rails 4.0.0.rc1 removed `:encrypted_cookie_store` as an option, as
it is the default now if using `:cookie_store` and `secret_key_base` is
set.