http -> https
lock mocha version and include rake ad dev dependency