lock down gems via bundler