allow activerecord '>= 3.2', '< 5.0'  as dependency
don't use mass assignment, validate presence/format of version