update gemfile to address vulnerabilities:

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection?utm_source=rubyweekly&utm_medium=email