bundle update so Gemfile.lock gets Rails 4.1.8 in response to security advisory