upgrade rails to 4.1.8

to address [CVE-2014-7829](https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk)