use gemfile to lock down dependencies