bump rails version
bump rails version and remove heroku gem
add secure headers to template