use explicit https url for rubygems, so bundler doesn't yell at us