Update to secure gemfile.
Show how I use http://bower.io

* Keeps everything in vendor/assets/components
* Sprockets find vendor/assets/components without any change needed or "components" path.
* Symlink component.json too root.
* Typically I configure my editor (Sublime) to ignore "vendor/assets/components" by adding it to my "folder_exclude_patterns". This means you can still see the component.json file at the root and all components are not greped by default or shown, just like gems.