Bump to rails 4.0.3 for security notice