used https rubygems site since `source :rubygems` is insecure
update Gemfile.lock