[real fix CVE-2014-7819] use 2.2.3 based sprockets

PR #2138 comment is wrong.

finnlabs/sprockets-rails#1