bumped Rails (to address CVE-2014-7829) and some other dependencies