Bump rails to 4.0.2

http://seclists.org/oss-sec/2013/q4/400