bundle update (rails to 4.1.4 in resp to secvuln)