switched to rails 4.0.2 due to security advisory