[real fix CVE-2014-7819] use 2.2.3 based sprockets

See commit logs.